[SOLVED] iptables data

battles · 09-05-2014, 05:15 PM

pkts bytes target prot opt in out source
8 320 DROP all -- * * 1.160.0.0/13
0 0 DROP all -- * * 1.161.21.237
58 2320 DROP all -- * * 1.163.0.0/16
907 43168 DROP all -- * * 61.174.0.0/16 /* china */
2248 134K DROP all -- * * 82.221.96.0/19 /* Croatia */

Does the pkts column represent the number of times the source has attempted to get into my server since I DROP(ed) them?

Thanks

es0teric · 09-09-2014, 02:11 AM

It represents the number of packets that have hit that rule. For example, zero packets have been dropped due to rule number 2, and 2248 packets have been dropped due to the last rule.

battles · 09-09-2014, 08:18 AM

That is what I thought was going on, but I wasn't sure. I have written a bash script that auto builds an iptables record that DROPs any intrusive hits to my web page (404, POST, PUT, DELETE, PATCH, TRACE, HEAD, CONNECT) or SSH hits (Failed password, POSSIBLE BREAK-IN ATTEMPT, authentication failure, Did not receive, Invalid user). It is probably similar to FailToBan, only it never reopens the DROPed IPs. I thought I would clean up the DROPs if they were 0.

Thanks.