I've been running into some bursts of traffic that have resulted in seeing 'max count of 65536 reached' in my syslog for a hashlimit rule that I use to rate limit NTP traffic (I run a public NTP server for the NTP pool). I know I can use --hashlimit-htable-max and --hashlimit-htable-size to increase the capacity, and obviously the htable-max value is currently set at 65536, but what is the default of the htable-size? I looked over the source and before going cross-eyed trying to make sense of it, I *think* the default calculates out as: htable-max = 8 * htable-size ??? Is this correct? Oddly enough after googling for hours it seems nobody has needed to increase this setting, or if they did they never posted about it. I only came across a few scattered posts with people basically asking the same question with no answer, the other 99% were just copy/paste of the generic content that is on the man page.
