0

I am trying to find a solution to dynamically filter network packets with strict timing constraints and based on a IP list on a Linux Operating System

I cannot install additional software of modify kernel or libraries to add modules to iptables for example

I have an equipment that receive too much network packet and I need to find a way to filter network packets dynamically with a 200ms cycle.

For example, let's say I have 3 IPs (192.168.0.1,192.168.0.2,192.168.0.3) I would need to dynamically change every 200ms the iptable configuration to block the 1st IP packets for the 1st 200ms cycle, then block the second IP packets for the 2nd 200ms cycle, so on and so forth

Would anyone know any efficient solution that take into accounts this stringent time constraint ? My first idea is to dynamically change the iptables configuration but I'm concerned about the performance and the timing,

Would anyone have performed the same kind of work or knows a solution already implemented and working ?

Thanks a lot for your help,

5
  • 3
    What is the problem that this proposed solution is intended to solve? It seems pretty strange and likely to be an XY problem. That said, I have never done what the question asks for in particular but with regard to dynamically changing addresses, I would say ipset may be helpful rather than changing the iptables rules. – Håkan Lindqvist Jun 16 at 19:26
  • Thanks a lot for your comment ! I did not know ipset and will have a look to it This solution would be temporary and aims to "filter" network packets to reduce the load on the equipment cpu. It is presently receiving too much messages and some of them are not intended to this equipment. However I cannot perform any l7 filtering because I lack the proper binaries or iptables modules in the kernel – Aeternal Jun 16 at 19:31
  • Sounds like you rather want to limit throughput? – vidarlo Jun 16 at 20:01
  • After some thinking, I think as well that rate-limiter using iptables on a per-IP basis is the best and easiest solution to implement – Aeternal Jun 16 at 21:58
  • correct you can simply use limit option in this case.(-m limit --limit count/minute --limit-burst ouny) – asmath Jun 17 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.