Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the rule in iptables for stop sync_flood attacks:

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --set

iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \
-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP


iptables: Unknown error 4294967295

I don't know what exactly to do, this ocurrs when insert the last rule "-m recent --name synflood --update --seconds 1 --hitcount 60 -j DROP"

Here the kernel version

share|improve this question
Maybe there's some kernel module that you need to load first? – joechip Aug 16 '12 at 1:34
up vote 2 down vote accepted

A quick search on Google for your error message lead to CentOS bug 3632, which says:

This is not a bug. You should increase maximum possible value for --hitcount parameter (20 by default) by setting ipt_recent module option ip_pkt_list_tot.

For example:

# cat /etc/modprobe.d/ipt.conf 
options ipt_recent ip_pkt_list_tot=200

Then reload module ipt_recent.

You're setting hitcount to 60, so this sounds like it's probably the root of your problem.

share|improve this answer
Thanks I make the changes you posted, and sorry, but, how i can reload the module ipt_recent? Thanks. Restarted iptables (service iptables restart) but the problem persist. – Kiwi Aug 16 '12 at 2:04
You can reboot, if that's an option. Otherwise, you should be able to modprobe -r ipt_recent, and then modprobe ipt_recent. This might fail because the recent module is in use, so you can try preceding it by service iptables stop to drop all of your firewall rules first. Make sure you save them! – larsks Aug 16 '12 at 2:09
Perfect! Many thanks, now the module was loaded correctly. – Kiwi Aug 16 '12 at 2:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.