1This patch adds a new match called 'hashlimit'. 2The idea is to have something like 'limit', but either per 3destination-ip or per (destip,destport) tuple. 4 5It gives you the ability to express 6.IP 7 '1000 packets per second for every host in 192.168.0.0/16' 8.IP 9 '100 packets per second for every service of 192.168.1.1' 10.P 11with a single iptables rule. 12.TP 13.BI "--hashlimit " "rate" 14A rate just like the limit match 15.TP 16.BI "--hashlimit-burst " "num" 17Burst value, just like limit match 18.TP 19.BI "--hashlimit-mode " "dstip,srcip,dstport,srcport" 20A comma-separated list of objects to take into consideration 21.TP 22.BI "--hashlimit-name " "foo" 23The name for the /proc/net/ipt_hashlimit/foo entry 24.TP 25.BI "--hashlimit-htable-size " "num" 26The number of buckets of the hash table 27.TP 28.BI "--hashlimit-htable-max " "num" 29Maximum entries in the hash 30.TP 31.BI "--hashlimit-htable-expire " "num" 32After how many miliseconds do hash entries expire 33.TP 34.BI "--hashlimit-htable-gcinterval " "num" 35How many miliseconds between garbage collection intervals 36