I have implemented a MAC address filter in my Linux router using Iptables. I would like to log dropped packets. And I would like to limit the logging rate. This is possible by the following command:

iptables -A WLAN -m limit --limit 1/hour -j LOG

The problem with the command is, that the rate limit works over all sources. If one source exceeds the limit other sources are not logged. I would like to define a rate limit based on the MAC address. The filter should log one packet per hour and per MAC address. Is this possible with Iptables?

I know that it is possible to filter for a specific known MAC address with

-m mac --mac-source xx:xx:xx:xx:xx:xx

But I do not know how to filter for a specific unknown MAC address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.