Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how?

I'd like to limit new ips to the average inbound packets of all previous ips on average with a slight burst.

This is to not have to increase the packet limits when the number of requests grows, so it should be kind of a very simply anomaly detection.

share|improve this question

This is more the job of QOS in conjunction with iptables. Basically, you use the MARK target to bind it to QoS rules set up with tc (from the iproute package).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.