Realistic max packets/sec per source IP?

Server operators
22

Good news about the firewall software update.

I went for a “quick and dirty” couple of lines in iptables. Similar rule for IPv6. The IPv4 rules gets a surprisingly high number of hits!

-A INPUT -p udp --destination-port 123 -d -m hashlimit --hashlimit-name ipv4-ntp-limit --hashlimit-above 3/s --hashlimit-burst 10 --hashlimit-mode srcip -j LOG --log-prefix "IPv4 NTP RL(3/s): "
-A INPUT -p udp --destination-port 123 -d -m hashlimit --hashlimit-name ipv4-ntp-limit --hashlimit-above 3/s --hashlimit-burst 10 --hashlimit-mode srcip -j DROP

23

My NTP reply packet rate limit is now 0 pckt/sec. Based on the syslog output of https://github.com/bruncsak/ntpflood-report a simple script puts into the iptables the DROP rule. It blocks only about 160 IP addresses.