Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say I have the following rules:

iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
iptables -A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -m recent --set --name counting1 --rsource 
iptables -A INPUT -m recent --update --seconds 60 --hitcount 2 --name counting1 --rsource -j LOG --log-prefix "SSH  ataque " 
iptables -A INPUT -m recent --update --seconds 60 --hitcount 2 --name counting1 --rsource -j RETURN 
-A INPUT -j ACCEPT

I've read the manual but I still don't understand exactly in what cases it's preferred either --rcheck or --update option... does update mean that the hitcount is reset to 0 and restart the (as in the above example) the 60 seconds?

Please bear in mind that these rules are only en example to expose this question

Thanks in advance

Thanks in advance

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

From the man page of iptables:

   [!] --rcheck
          Check if the source address of the packet is  currently  in  the
          list.

   [!] --update
          Like  --rcheck,  except it will update the "last seen" timestamp
          if it matches.

So, using update will not reset the hitcount, it will (re)set the last seen timestamp. The following is said about --seconds:

   --seconds seconds
          This  option must be used in conjunction with one of --rcheck or
          --update. When used, this will narrow the match to  only  happen
          when  the  address  is  in the list and was seen within the last
          given number of seconds.

That means using --rcheck makes the rule to match only the time interval scecified in the rule (e.g. with --seconds) at a time, while using --update will extend the time interval the rule is being matched if matching packets are encountered during the interval.

So, if there is a matching packet every 45 secs the example rules shown in the question will keep on logging the packets and returning from the chain. OTOH if --rcheck had been used, every second packet would not be matched (as the 60 sec interval for two matching packets has expired).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.