How to see the full list of ip addresses in 'recent' module? I want to see current hitcounts to adjust my values accordingly so no valid users gets accidentally blocked
1 Answer
It is in the files below /proc/net/xt_recent/
assuming a new kernel.
-
Thank you! Any idea how to figure out current hitcounts from this packets numbers?– PomaDec 20, 2011 at 10:53
-
1First: Read the manual. Second: Seen the numbers?
oldest_pkt: 2
means "two". Got it?– mailqDec 20, 2011 at 10:56 -
1There isn't a way to figure out hitcounts from that file; oldest_pkt tells you which position in the list the oldest packet is, because it is a ring buffer. If you want hit counts, try
iptables -vL
(key here being adding-v
to the usualiptables -L
), which should show you the success count for each rule in the first column ("pkts"). Jul 25, 2022 at 12:48 -
@Score_Under Wouldn't the number of entries in the ring buffer (which I suppose follows the
oldest_pkt
field) representing the currenthitcount
? Nov 11, 2022 at 19:07 -
The nature of a ring buffer is that it will be overwritten regularly, and has a fixed maximum size Nov 15, 2022 at 11:24