What do the fields in /proc/net/ipt_hashlimit/FILE mean?

Question

What do the fields in /proc/net/ipt_hashlimit/FILE mean?

These files are created upon iptables -A CHAIN -m hashlimit--hashlimit-name FILE [...]

[...] 9 198.51.100.23:0->0.0.0.0:0 80000 80000 160 [...]

The first column shows the time in seconds when the entry of the hashlimit will be removed by the garbage collection, if there are no matched packets for the rule.

The second column is based upon the mode you specify with --hashlimit-mode In this case it is srcip. It shows the srcip here.

What are the meaning of columns 3,4 and 5?

Answer 1

Based on the C structure (net/ipv4/netfilter/ipt_hashlimit.c) and assorted comments :

struct {
    unsigned long prev; /* last modification */
    u_int32_t credit;
    u_int32_t credit_cap, cost;
} rateinfo;

It seems fields 3 to 5 have this meaning :

• 3 is the current "credit" (re-incremented of 1 every jiffy)
• 4 is the credit cap (cost * settings for "--hashlimit-burst")
• 5 is the cost (i.e how much credit is decremented every time the rule is matched)

If credit gets to 0 then the hash entry has gone over limit.

For instance :

8 A.B.C.D:0->0.0.0.0:0 6400 6400 1280

would have a credit of 6400 out of possible 6400, with each match costing 1280. This means basically that this entry has replenished its full credit and is well behaved.