Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program

Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program that reads from the queue. So it could do the rate limiting there with full visibility. https://github.com/aidansteele/ipv6-ghost-ship/blob/main/main.go https://github.com/aidansteele/ipv6-ghost-ship/blob/main/mai...