6

How to see the full list of ip addresses in 'recent' module? I want to see current hitcounts to adjust my values accordingly so no valid users gets accidentally blocked

1 Answer 1

7

It is in the files below /proc/net/xt_recent/ assuming a new kernel.

5
  • Thank you! Any idea how to figure out current hitcounts from this packets numbers?
    – Poma
    Dec 20, 2011 at 10:53
  • 1
    First: Read the manual. Second: Seen the numbers? oldest_pkt: 2 means "two". Got it?
    – mailq
    Dec 20, 2011 at 10:56
  • 1
    There isn't a way to figure out hitcounts from that file; oldest_pkt tells you which position in the list the oldest packet is, because it is a ring buffer. If you want hit counts, try iptables -vL (key here being adding -v to the usual iptables -L), which should show you the success count for each rule in the first column ("pkts"). Jul 25, 2022 at 12:48
  • @Score_Under Wouldn't the number of entries in the ring buffer (which I suppose follows the oldest_pkt field) representing the current hitcount? Nov 11, 2022 at 19:07
  • The nature of a ring buffer is that it will be overwritten regularly, and has a fixed maximum size Nov 15, 2022 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .