此IPTable（更新、秒数、命中数）规则的作用是什么？（debian）

我不完全理解它是如何工作的，我只知道当某个东西在3秒内通过UDP命中超过50次时，它将被丢弃

但是，要多久？它是否仅限于50次点击？ 是每个人50次点击还是每个IP 50次点击

---

我会说，这是每个源IP地址，只要在过去3秒内该源IP地址的点击次数超过49次，它们就会被丢弃。

因此，这基本上将每个IP限制为每3秒50个数据包，如果它们发送的数据包超过50个，IP就会被丢弃，直到3秒过去，它们可以发送另一个数据包。我的假设正确吗？基本上就是这样。只是考虑一下，根据流量分配，它可以在3秒之前停止丢弃数据包。作为一个固定的时间窗口，它取决于最后接收到多少数据包。只是一个细节：与其说“IP将被丢弃”，不如说“来自该源IP地址的数据包将被丢弃”。我投票结束这个问题，因为一般的IPTABLES支持是离题的。支持问题可在上提出。此标记仅用于有关使用iptables编程的问题。应在服务器故障（）上询问有关配置iptables的问题。

-- Watch for packets
iptables -I INPUT -p udp -m state --state NEW -m recent --set

-- Drop flooders
iptables -I INPUT -p udp -m state --state NEW -m recent --update --seconds 3 --hitcount 50 -j DROP

[!] --rcheck
Check if the source address of the packet is currently in the list.
[!] --update
Like --rcheck, except it will update the "last seen" timestamp if it matches.
[!] --remove
Check if the source address of the packet is currently in the list and if so that address will be removed from the list and the rule will return true. If the address is not found, false is returned.
[!] --seconds seconds
This option must be used in conjunction with one of --rcheck or --update. When used, this will narrow the match to only happen when the address is in the list and was seen within the last given number of seconds.
[!] --hitcount hits
This option must be used in conjunction with one of --rcheck or --update. When used, this will narrow the match to only happen when the address is in the list and packets had been received greater than or equal to the given value. This option may be used along with --seconds to create an even narrower match requiring a certain number of hits within a specific time frame.