Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible with iptables to limit inbound packets by source-ip based on the number of average inbound packets for all source-ips? If so, how?

I'd like to limit new ips to the average inbound packets of all previous ips on average with a slight burst.

This is to not have to increase the packet limits when the number of requests grows, so it should be kind of a very simply anomaly detection.

share|improve this question
add comment

1 Answer 1

This is more the job of QOS in conjunction with iptables. Basically, you use the MARK target to bind it to QoS rules set up with tc (from the iproute package).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.