I have implemented a MAC address filter in my Linux router using Iptables. I would like to log dropped packets. And I would like to limit the logging rate. This is possible by the following command:
iptables -A WLAN -m limit --limit 1/hour -j LOG
The problem with the command is, that the rate limit works over all sources. If one source exceeds the limit other sources are not logged. I would like to define a rate limit based on the MAC address. The filter should log one packet per hour and per MAC address. Is this possible with Iptables?
I know that it is possible to filter for a specific known MAC address with
-m mac --mac-source xx:xx:xx:xx:xx:xx
But I do not know how to filter for a specific unknown MAC address.