Im looking at SSH bruteforce prevention with iptables recent module.

I would like to know how does the --hitcount collect the value that it will use? Is it bytes, packets, no. of conntracked items or something else?



  • The counter gets updated whenever the rule to do so is triggered. That depends on how and where you configure it, so include your iptables rule set for an actual answer please. – HBruijn Apr 29 '16 at 5:50

--rcheck --hitcount checks the value of an internal counter which is incremented by one for each hit on a -m recent --set (or --update) rule of the same --name. Rules are evaluated in the context of packets, so the number of packets is the tracked quantity. This from the man page for iptables on my CentOS 6 system:

   --hitcount hits

[...] When used, this will narrow the match to only happen when the address is in the list and packets had been received greater than or equal to the given value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.