| View previous topic :: View next topic |
| Author |
Message |
toralf
Developer
Joined: 01 Feb 2004
Posts: 3922
Location: Hamburg
|
 Posted: Sat Jul 30, 2016 10:56 am Post subject: [solved] detect amount of new outgoing tcp conns per port |
 |
|
I'd like to be informed (but not more often than once per second) if the amount of new outgoing connections to destination port $p per second is greater than 250. The following approaches don't work as expected: | Code: | $IPT -A OUTPUT -p tcp --destination-port $p --syn --match connlimit --connlimit-above 250 --connlimit-mask 32 --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p "
$IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit --connlimit-above 250 --connlimit-mask 32 --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p "
$IPT -A OUTPUT -p tcp --destination-port $p --syn --match state --state NEW --match limit --limit 250/second --match limit --limit 1/second -j LOG --log-prefix "PORTMAX $p "
|
Any hints ?
Last edited by toralf on Thu Aug 11, 2016 8:49 pm; edited 4 times in total |
|
| Back to top |
|
 |
Syl20
l33t
Joined: 04 Aug 2005
Posts: 619
Location: France
|
| Posted: Mon Aug 01, 2016 12:47 pm Post subject: |
|
|
Did you try to split the connlimit filter and the limit one into two distinct rules ?
| Code: | $IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit ! --connlimit-above 250 --connlimit-mask 32 -j ACCEPT # or -j WHATYOUWANT
$IPT -A OUTPUT -p tcp --destination-port $p --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p " |
Note that here, the supplemantary packets will just be logged. You may have to add another rule to accept or to drop them. |
|
| Back to top |
|
|
toralf
Developer
Joined: 01 Feb 2004
Posts: 3922
Location: Hamburg
|
| Posted: Mon Aug 01, 2016 1:24 pm Post subject: |
|
|
Well, I finally got it with one rule : | Code: | | $IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match limit --limit 1/second --limit-burst 1 --match connlimit --connlimit-above $max -j LOG --log-prefix "PORTMAX $p " |
but is this the most simple solution ?
Update
Seems to be better: | Code: | | $IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit --connlimit-above 250 --connlimit-mask 0 --connlimit-daddr --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p m2 " |
|
|
| Back to top |
|
|
|
Networking & Security
