All of lore.kernel.org
 help / color / mirror / Atom feed
* iptable rule addition has no effect .
@ 2010-03-05  5:33 ratheesh k
  2010-03-05  9:32 ` Mart Frauenlob
  0 siblings, 1 reply; 2+ messages in thread
From: ratheesh k @ 2010-03-05  5:33 UTC (permalink / raw)
  To: netfilter

i m  flooding  an interface using hping with UDP packets .

I have a rule

    iptables -A INPUT -p udp -j DROP

I can see all packets are getting dropped . i can see processor
utilization is high using "top" command and system becomes slow .

But while flooding , if  i add rule

iptables -I INPUT -j ACCEPT .

still packets gets dropped .

 But if i  stop flooding and start hping again { with same rules }  ,
packets are accepted .

Note : I am working on an embedded enviornement  with 128kB of RAM .

any hints is really appreciated .

Thanks,
Ratheesh.

^ permalink raw reply	[flat|nested] 2+ messages in thread
* Re: iptable rule addition has no effect .
  2010-03-05  5:33 iptable rule addition has no effect ratheesh k
@ 2010-03-05  9:32 ` Mart Frauenlob
  0 siblings, 0 replies; 2+ messages in thread
From: Mart Frauenlob @ 2010-03-05  9:32 UTC (permalink / raw)
  To: netfilter

On 05.03.2010 06:33, netfilter-owner@vger.kernel.org wrote:
> i m  flooding  an interface using hping with UDP packets .
> 
> I have a rule
> 
>     iptables -A INPUT -p udp -j DROP
> 
> I can see all packets are getting dropped . i can see processor
> utilization is high using "top" command and system becomes slow .
> 
> But while flooding , if  i add rule
> 
> iptables -I INPUT -j ACCEPT .
> 
> still packets gets dropped .
> 
>  But if i  stop flooding and start hping again { with same rules }  ,
> packets are accepted .
> 
> Note : I am working on an embedded enviornement  with 128kB of RAM .
> 
> any hints is really appreciated .

> 

guessing:
could it be you use conntrack, and nf_conntrack_max is reached?


^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-03-05  9:32 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-03-05  5:33 iptable rule addition has no effect ratheesh k
2010-03-05  9:32 ` Mart Frauenlob

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.