<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Andale Mono; font-size: 10pt; color: #000000'>I'm not thinking that would work in the case of a relay agent - These packets would all appear to come from the relay agent and the relay agent would get blocked, not the end-user device.<br><br><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid rgb(16, 16, 255);margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Jeff Waller" <jeffw@cnxntech.com><br><b>To: </b>"Users of ISC DHCP" <dhcp-users@lists.isc.org><br><b>Sent: </b>Wednesday, March 7, 2012 1:12:39 PM<br><b>Subject: </b>Re: does isc dhcp 4.2.3 support blocking client which send many<br><br><br>On Mar 7, 2012, at 10:52 AM, Simon Hobson wrote:<br><br>> Martin McCormick wrote:<br>> <br>>> A good mechanism for controlling insane systems<br>>> might be to read time intervals between each MAC address contact<br>>> and start ignorring anybody who has contacted DHCPD more than X<br>>> number of times in X number of seconds.<br>> <br>> Which is the sort of task Logwatch was written for. Anyone know if <br>> any DHCP filters/actions have been written for it ?<br>> <br>> However, that won't work for devices behind a relay agent. And <br>> someone said that iptables doesn't work either.<br><br>IP tables can be made to work. Someone is being dumb.<br><br>Here's A link from 5m of google;<br>http://www.wjunction.com/48-technical-security-tutorials/107901-linux-ddos-protection.html<br>http://www.infond.fr/2010/04/basics-6-tutorial-firewall-iptables.html<br><br>Form the 2nd source, seems approximately the same;<br><br>#9 allow 5 TCP connexion attempts <br># with 2 per minuts frequency<br>#iptables -A INPUT -m state --state NEW -m recent --set<br>#iptables -A INPUT -m state --state NEW -m recent --update --hitcount 6 -j DROP<br>#iptables -A INPUT -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP<br><br>> <br>> -- <br>> Simon Hobson<br>> <br>> Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed<br>> author Gladys Hobson. Novels - poetry - short stories - ideal as<br>> Christmas stocking fillers. Some available as e-books.<br>> _______________________________________________<br>> dhcp-users mailing list<br>> dhcp-users@lists.isc.org<br>> https://lists.isc.org/mailman/listinfo/dhcp-users<br><br>_______________________________________________<br>dhcp-users mailing list<br>dhcp-users@lists.isc.org<br>https://lists.isc.org/mailman/listinfo/dhcp-users<br><br></blockquote><br></div></body></html>