Could anybody advise please, how do I calculate the correct numbers for --limit and --limit-burst for a given server with certain parameters? For example:

iptables -A INPUT -p tcp -m state --state NEW -m limit --limit 2/second --limit-burst 2 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -j DROP

The INPUT policy is accept. How do I calculate the numbers? --limit 2/second or limit 2/minute, --limit-burst 2 or 5? Are there any formulas applied based my server's parameters / performance?

Would be thankful for any assistance / pointers / suggestions.

  • This rule is supposed to limit SYN-REC floods and it's just an example. I would like to know how to get these numbers correctly in general, please. – Guest Aug 14 at 4:09
  • You probably want to edit your question to clarify a bit more. Only in specific scenarios will you be able to add useful mitigations on the receiving end of abusive traffic. – anx Aug 14 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.