Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a system which is configured as SNMP agent and sends the TRAPS to some other remote m/c which is configured as SNMP manager.Now from this SNMP agent i want tot rate limit the SNMP traps using IPTABLES utility existing in Linux.Instead of writing a seperate application to rate limit the SNMP traps to SNMP manager , i want ot achieve this feature using the IPTABLE rule in OUTPUT chain. Is it possible! if yes can anybody suggest the rule in output chain.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Something like this:

iptables -A OUTPUT -p tcp --dport 161 -m limit --limit 3/min --limit-burst 3 -j ACCEPT 
iptables -A OUTPUT -p tcp --dport 161 -j DROP 
iptables -A OUTPUT -p udp --dport 161 -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -A OUTPUT -p udp --dport 161 -j DROP

Tweak with --limit and --limit-burst values until you like the result.

From Rusty's Remarkably Unreliable Guides (http://www.netfilter.org/documentation/index.html#documentation-howto):

limit
        This module must be explicitly specified with `-m limit' or
        `--match limit'. It is used to restrict the rate of matches,
        such as for suppressing log messages. It will only match a given
        number of times per second (by default 3 matches per hour, with
        a burst of 5). It takes two optional arguments:

        --limit
           followed by a number; specifies the maximum average number of
           matches to allow per second. The number can specify units
           explicitly, using `/second', `/minute', `/hour' or `/day', or
           parts of them (so `5/second' is the same as `5/s').

        --limit-burst
           followed by a number, indicating the maximum burst before the
           above limit kicks in.
share|improve this answer
    
Hi, thanks a lot for the answer, but i have doubt here, first we are accepting the traffic on dport 161 in output chain and then the next rule is drop rule!! can you please explain me why we have to write a drop rule here.... –  srinuvenu May 18 '11 at 2:36
    
iptables process rules in order. First packets will match the rate-limiting rule and be ACCEPTed. Subsequent packets will not match the rule, so the next rule will be used. Therefore we want packets, that travel on SNMP ports, but did not match the rate-limiting rule (i.e. there were too many of them) to be DROPped. –  Paweł Brodacki May 18 '11 at 4:27
    
Ohh!!! Ok thanks a lot, i understood the point..i'll try this in my system –  srinuvenu May 18 '11 at 5:10
    
small change here in the udp port number iptables -A OUTPUT -p udp --dport 162 -m limit --limit 3/min --limit-burst 3 -j ACCEPT iptables -A OUTPUT -p udp --dport 162 -j DROP –  srinuvenu May 19 '11 at 14:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.