Discuss mailing list

[Christopher <weblionx AT gmail.com>]

Have you tried adding a second rule for TCP connections? Usually
they're not used, but if it's some sort of botnet it may be configured
to try both to increase its chances of success. This would also cause
higher bandwidth usage. Of course, this assumes the server accepts TCP
connections.

On Tue, Dec 28, 2010 at 10:51 PM, Jeff Taylor <shdwdrgn AT sourpuss.net> wrote:

> iptables -A INPUT -p udp --dport 53 -m limit --limit 20/s --limit-burst 40 
> -j DROP

...

> Now I say this rule 'should' limit traffic, because as I type this I am
> seeing another wave coming through from two IP's that prompted my blocks
> earlier today.  Apparently the rule is not doing what I expect as my
> bandwidth jumped from about 10Kb/s to over 1800Kb/s (two IP addresses
> slamming me with about 16,000 queries in 3 minutes).  So again, if someone
> else has more experience with iptables, I've love to see a proper rule for
> this situation.