Package: iptables
Version: 1.3.5.0debian1-1
Severity: minor
Seems hashlimit docs are mine ;)
1) --hashlimit-mode destip | destip-destport
Limit per IP or per port
This is incorrect. The correct text could be:
--hashlimit-mode dstip | dstport | srcip | srcport
Limit per IP or per ip+port
2) It should be noted (and preferably forwarded upstream) that it is
impossible to _change_ or _replace_ a hashlimit with the same
hashlimit-name: kernel code lies that the limit was changed but
the /proc/net/ipt_hashlimit/whatever file still reflects the old
limit values and it really acts so.
(Example:
iptables -A test -m hashlimit --hashlimit 1/sec --hashlimit-name foo
iptables -R test 1 -m hashlimit --hashlimit 10/sec --hashlimit-name foo
it still limits at 1/sec, opposite of what iptables -L -nv tells.)
Moral of the story: if you want to change limit settings you have
to give the hashlimit a new name.
This should be documented.
Peter
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
