2 ms·
OK, I see "length" extension in man iptables-extensions (Debian 8), so for example, to drop pings with a packet size greater than 85 bytes: # iptables -A F
by txutxu 11y ago
OK, I see "length" extension in man iptables-extensions (Debian 8), so for example, to drop pings with a packet size greater than 85 bytes:
# iptables -A FORWARD -p icmp --icmp-type echo-request -m length --length 86:0xffff -j DROP
Still, until someone checks the code of this tool, or a working test environment, we won't know if the rule stops this tool.
Update: as for the number of packets, there is -m limit and other recipes.
- ryan-c 11y agoIf you're going to do that, set the maximum length to 128 bytes. Different ping tools use different sized payloads - I know of some common ones that generate packets by default that would be blocked with that limit. Also, instead of using the plain limit match, check out hashlimit. It can apply a rate limit on a per sender, destination, or sender+destination basis. The recent match may also be of interest.