On Mon, Sep 28, 2020 at 01:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> On 28/09/2020 14:24, Pablo Neira Ayuso wrote:
> > On Mon, Sep 28, 2020 at 12:08:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > In the below example it does not print any logs and since that stanza is
> > > right prior drop I reckon that since the log printing does not happen the
> > > frame dropping does neither.
> > >
> > > table inet filter {
> > [...]
> > > chain wan_pr {
> > > ct state { new } update @glv4 { ip saddr limit rate over
> > > 15/day burst 3 packets } log prefix "glv4 DROP: " flags all drop
> > > }
> > > }
> > ct state new is restricting to match only on the first packet of the
> > connection.
>
> Right, it should be then rather something with ct count, like:
>
> ct state new update @glv4 { ip saddr ct count over 15 } log flags all prefix
> "glv4 DROP: " drop
>
> but that produces:
>
> Error: Could not process rule: Not supported
What would you like to achieve in first place?
This thread is starting to diverge from the original question.
