Hello list, Here are two "recent" rules: /usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent \ --update --seconds 60 --hitcount 5 --name smtp -j LOG_REJECT /usr/sbin/iptables -A INPUT -p tcp --dport 25 -m recent --set \ --name smtp -j ACCEPT When telnetting for the first time to port 25, the source ip appears in /proc/net/xt_recent/smtp So far, so good. But there are 100 entries according to the manpage: $ wc -l /proc/net/xt_recent/smtp 100 Correct. OTOH, I'm sure that within seconds the 100 entries will be exceeded, according to the number of connections set up to the smtp server: # tcpdump -ni eth0 \ 'dst host 10.1.193.3 and tcp port 25 and tcp[13] == 2' (outputs a few per second) And according to /proc/net/ip_conntrack there are more than 100 entries to 25/tcp. Where are the entries 101 and higher in /proc/net/xt_recent/smtp? Are they ignored? Or is the oldest automagically purged? And when is an entry purged when the --reap is not used? Or does it behave like a round robin FIFO? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+ -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
