I was thinking of adding the following rule to my IP tables:
-A INPUT -p tcp -m state --state NEW -m recent --update --dport 80 --seconds 5 --hitcount 10 -j DROP -A INPUT -p tcp -m state --state NEW -m recent --set --dport 80 -j ACCEPT
to avoid accidental Ajax-based abuse (too many requests) of my web API.
Is this sort of stateful filtering considered resource-intensive or otherwise wasteful due to the commonness of port 80 requests (vs something like rate-limiting port 22 which would result in a lot less state)? I realize that doing this in a dedicated firewall would be ideal, but I'm trying to see what I can accomplish in my server.