Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server occasionally get massively hit by (probably bots) on a small group of IPs. Is there a good way (probably in iptables) to slow down or temporarily block/tarpit connections coming from an IP that has connected many times recently?

share|improve this question
up vote 0 down vote accepted

Yes, iptables supports this kind of dynamic rate limiting.

See here for details:

share|improve this answer
Hmm... it seems that I cannot set a --hitcount over 20... that's not very useful in this case. Is there a way around that? – singpolyma Dec 20 '11 at 16:09

Maybe denyhosts would be a useful tool for you.

share|improve this answer
I'm using denyhosts already for ssh traffic, yes :) – singpolyma Dec 20 '11 at 16:08
Denyhosts needs an auth log to read... These are not failures of any kind, just DNS queries. – adaptr Dec 20 '11 at 16:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.