另外給一些資訊另外也 hashlimit 這 match extension:
hashlimit
This patch adds a new match called 'hashlimit'. The idea is to have something like 'limit',
but either per destination-ip or per (destip,destport) tuple.
It gives you the ability to express
'1000 packets per second for every host in 192.168.0.0/16'
'100 packets per second for every service of 192.168.1.1'
with a single iptables rule.
--hashlimit rate
A rate just like the limit match
--hashlimit-burst num
Burst value, just like limit match
--hashlimit-mode dstip,srcip,dstport,srcport
A comma-separated list of objects to take into consideration
--hashlimit-name foo
The name for the /proc/net/ipt_hashlimit/foo entry
--hashlimit-htable-size num
The number of buckets of the hash table
--hashlimit-htable-max num
Maximum entries in the hash
--hashlimit-htable-expire num
After how many miliseconds do hash entries expire
--hashlimit-htable-gcinterval num
How many miliseconds between garbage collection intervals
复制代码
--
[ 本帖最后由 kenduest 于 2008-6-13 22:31 编辑 ]
