Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

centos 5.x

I'm trying to wrap my mind around the following iptables rule on one of my servers:

-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

On another server I have:

-A RH-Firewall-1-INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 3 -j ACCEPT

I understand that both of these rules are designed to allow (and throttle) incoming ping requests but what is the limit-burst option about? And are these allowances on a per host basis? Or do they apply to any/all incoming ICMP connections at all?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

The math is fully explained in the netfilter docs, but it's reasonable to say that the limit-burst argument specifies the number of matches that are allow through before the limit of 1 per second "kicks in". These two rules both apply only to ICMP echo request packets (incoming PING requests). These are not per-host limits and apply to anything the rule matches (which, in this case, would be all ICMP echo requests).

share|improve this answer
    
So for the second rule, it will allow up to 3 icmp echo request packets (no matter how quickly they're received) and then only allow 1 icmp packet per second after that (regardless of which host the request is coming from)? At what point does iptables "reset" and allow a burst of up to three packets again? –  Mike B Mar 6 '13 at 23:05
3  
It's a token bucket. The bucket starts w/ 3 tokens in it, and a token is removed for each ICMP echo-request that is received. For each 1 second of no ICMP echo requests 1 token is added to the bucket until the bucket reaches 3 tokens again, where it stays until it receives more ICMP echo requests. –  Evan Anderson Mar 6 '13 at 23:42
    
Awesome. That's exactly what I needed to know. Thank you sir. –  Mike B Mar 7 '13 at 0:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.