Dear All,

OS: CentOS 5.5 64bit
Application: JBOSS 4.2.3


I want to log HTTP request for all the IP which sends 700 and above request per minute.

Below rule do not work as the hit count is too high.
iptables -A INPUT -p tcp -s 0/0 --dport 8080 -m recent --set --name HTTP
iptables -A INPUT -p tcp -s 0/0 --dport 8080 -m recent --update --seconds 60 --hitcount 700 --rttl --name HTTP -j LOG

you should not be trying to log jboss request through iptables but it must be done through greping jboss server logs via shell script in cron job or which ever way you like.

why not? If he's after specific traits of the network traffic, and not necessarily the actual application usage then I'd say iptables is the perfect place to do this. Having said that though, the request was 700 requests, not 700 packets...

looking around, you can change the hitcount values by setting ipt_pkt_list_tot when you explictly load the module in modprobe.conf, but all talk about it I see is setting it at 5o or 60 when the default is 20, and 700 is a serious amount higher. Maybe you could reduce the numbers you're tracking? Say, 50 in 5 seconds instead?

You could reduce the number of applicable hits by only tracking it on the new connections also, but then any connections being reused would not be relevant.

@ashwin_cse
If it was just to log I would use log4j and yes I am using it.

what I actually meant by -j LOG is, If satisfied by the output of log then turn -j LOG to -j DROP.

I would say 700 hundred request per minute would be the ideal solution.

Why?

eg: say 50 in 5 sec

In this case a give IP would send 50 request within 5 sec and for next 55 sec it might not send any request. In this case I dont want to log. Only if the total request for 60 sec reaches 700 then it should log.