Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a websocket server that accepts connections. Unfortunately, for a reason that we have yet to identify some clients go rogue and connect/disconnect/connect... in loop at a very high frequency. This is a mess to deal with and penalizes other legit clients.

I added IPTABLE records to drop their traffic, but soon enough, another client starts to mess up. At the same time, a client who used to behave badly may start to behave normally again. It doesn't scale very much to edit the IPTABLE manually all day long.

Is there a way to dynamically block traffic from these clients who try to connect too often? I'd rather avoid to do that at the websocket server, because of course when doing this, this takes resources away from other legit clients.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, you can configure iptables to block a certain frequency of connection requests from a client:

http://www.debian-administration.org/articles/187

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

Basically limiting users to only connect 10 times a minute.

share|improve this answer
    
Could this also be triggered by repeated requests for images? And I was under the impression that web sockets doesn't reconnect each time, but keeps the connection open. –  Matt Simmons Sep 19 '11 at 18:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.