IPTables hashlimit-above incorrect count

Davisn23 · 09-14-2016, 02:01 AM

Hi,

I'm currently having trouble trying to setup a rule on IPTables to rate-limit certain packets. I can't just use the normal limit mode on iptables as this has to be per dstip and dstport.

The rule looks like this:

Code:

iptables -A PREROUTING -t raw -p udp -m hashlimit -m u32 --u32 "0x0>>0x16&0x3c@0x9&0xff=0x55" --dport 27015:27105 --hashlimit-mode dstip,dstport --hashlimit-above 500/sec --hashlimit-name PLAYERQUERY -j DROP

This seems to work correctly and will rate-limit when a significant amount comes in, however I can see random packets being dropped even when under the 500/sec limit. I'm verifying this by using wireshark across our nodes and I'm only seeing maybe 20~ a second.

Regards,
David

lazydog · 09-15-2016, 08:50 AM

You are seeing packets being dropped but you are not logging why they are being dropped. You should log all packets being dropped and label them as to what they are being dropped for then you would have a better understanding what is being dropped and why. Presently you are shooting in the dark and hoping to find the target.

Just because packets are being dropped doesn't mean the above rule is dropping them.

EricStJEan · 09-20-2016, 02:53 AM

Hi

lazydog, it's easy to see that the rule drop paquets with the "-v" argument of iptables. Maybe Davisn23 did that....

i have the same probleme of Davisn23 with another similar rule:
rule "B":
iptables -I INPUT 1 -m hashlimit -m tcp -p tcp --dport 80 -i eth0 --hashlimit-above 256/sec --hashlimit-burst 512 --hashlimit-mode srcip --hashlimit-name reg_html1 -m state --state NEW -j DROP

I saw some ramdom packet drop with that rule (iptables -t filter -L -v)

A rule "A", before this one, shows that the rate limit is not the reason of the drops:
iptables -I INPUT 1 -p tcp --dport ssh -m state --state NEW -m recent --set

So if i test the rules with a rate of a few packets per second (less than 256/sec ) i see that paskets in the rule A, and from time to time, rule "B" drops some packets.

Regards,
Eric

Davisn23 · 09-21-2016, 02:56 PM

Quote:

Originally Posted by EricStJEan

Hi

lazydog, it's easy to see that the rule drop paquets with the "-v" argument of iptables. Maybe Davisn23 did that....

i have the same probleme of Davisn23 with another similar rule:
rule "B":
iptables -I INPUT 1 -m hashlimit -m tcp -p tcp --dport 80 -i eth0 --hashlimit-above 256/sec --hashlimit-burst 512 --hashlimit-mode srcip --hashlimit-name reg_html1 -m state --state NEW -j DROP

I saw some ramdom packet drop with that rule (iptables -t filter -L -v)

A rule "A", before this one, shows that the rate limit is not the reason of the drops:
iptables -I INPUT 1 -p tcp --dport ssh -m state --state NEW -m recent --set

So if i test the rules with a rate of a few packets per second (less than 256/sec ) i see that paskets in the rule A, and from time to time, rule "B" drops some packets.

Regards,
Eric

Hi,

Yes, I was verifying this with the -nvL option.