1This patch adds a new match called 'hashlimit'.
2The idea is to have something like 'limit', but either per
3destination-ip or per (destip,destport) tuple.
4
5It gives you the ability to express
6.IP
7 '1000 packets per second for every host in 192.168.0.0/16'
8.IP
9 '100 packets per second for every service of 192.168.1.1'
10.P
11with a single iptables rule.
12.TP
13.BI "--hashlimit " "rate"
14A rate just like the limit match
15.TP
16.BI "--hashlimit-burst " "num"
17Burst value, just like limit match
18.TP
19.BI "--hashlimit-mode " "dstip,srcip,dstport,srcport"
20A comma-separated list of objects to take into consideration
21.TP
22.BI "--hashlimit-name " "foo"
23The name for the /proc/net/ipt_hashlimit/foo entry
24.TP
25.BI "--hashlimit-htable-size " "num"
26The number of buckets of the hash table
27.TP
28.BI "--hashlimit-htable-max " "num"
29Maximum entries in the hash
30.TP
31.BI "--hashlimit-htable-expire " "num"
32After how many miliseconds do hash entries expire
33.TP
34.BI "--hashlimit-htable-gcinterval " "num"
35How many miliseconds between garbage collection intervals
36