Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Well up-til now I've considered iptables rate-limit commands with the "recent" module to work for each IP Address. For example rate-limit rule of 20k/s will trigger only if a single IP exceeds 20k/s rate and not if 4 different IPs exceed 5k/s rate. Please correct me if I considered this wrong as I've only used these rules for TCP/ UDP.

But today I tried similar rules for ICMP and applied 4/s Input/Output. But then on trying to ping-test from just-ping.com I could see packet loss on almost all IP Addresses. How could that happen because if it worked for each IP Address then it wouldn't be triggering the rule because I believe each IP from just-ping has a rate of probably 1/s.

I still think the first one is true because if it wasn't then my GameServer would block everyone if the combined rate ( in case of more connected players ) increased the threshold. This hasn't happened up til now so the ICMP thing really confused me.

Thank you.

UPDATE

Here is my config:

-A INPUT -p icmp -m recent --set --name PING --rsource 
-A INPUT -p icmp -m recent --update --seconds 1 --hitcount 4 --name PING --rsource -j DROP 

-A OUTPUT -p icmp -m recent --set --name PING2 --rsource 
-A OUTPUT -p icmp -m recent --update --seconds 1 --hitcount 4 --name PING2 --rsource -j DROP 
share|improve this question
1  
To the best of my knowledge, the recent module does not limit the rate the way you would expect. It does not provides QoS in terms of bandwith throttling but only counts the number of times an ip tries to access a port using a given protocole. –  ripat Jul 2 '12 at 14:49
    
Post your config so more accurate help can be given :) –  jwbensley Jul 2 '12 at 16:14
    
Well my config for ICMP is not much different than what CSF does. But i see even in CSF, i have packet loss if icmp is rate-limited using the csf config and not iptables. Exactly same thing happened on a CSF. –  Asad Moeen Jul 3 '12 at 14:58
    
Well my config for ICMP is not much different than what CSF does. But i see even in CSF, i have packet loss if icmp is rate-limited using the csf config and not iptables. Exactly same thing happened on a CSF. –  Asad Moeen Jul 4 '12 at 8:19
    
Config updated. –  Asad Moeen Jul 4 '12 at 8:24

1 Answer 1

up vote 0 down vote accepted

Okay after some research into this one as well I see that the icmp echo-request when made through multiple-IPs or even in MTR packets is probably not actually 1/s. Setting it as high as 20/s makes it work good and the packets are no longer blocked. Though I still couldn't find why the rate is more than 5/s for echo-request.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.