what exactly are the practical differences between iptables recent module and ipset ?

I know recent module only allows IPs, whereas ipset allows subnets. But other than this, what is the main practical difference? Is it performance? Which one of those should I use?

  • One thing for sure is that it greatly depends on the number of rules and the number of simultaneous requests.
    – MC68020
    Commented Feb 27, 2023 at 15:16

1 Answer 1


The iptables recent module is used for tracking packets that match certain criteria, such as the source IP address and port, and adding them to a list. Once a packet matches the criteria, it can be marked, logged, or dropped. This module is typically used for implementing rate-limiting or firewall rules that limit the number of connections or requests from a particular IP address.

The ipset tool, on the other hand, is used for managing large sets of IP addresses or other network objects, such as network ranges, MAC addresses, and ports. These sets can be used by other tools, such as iptables or tc (traffic control), to apply policies to packets that match the set criteria. ipset provides more advanced features than the recent module, such as the ability to create sets that are dynamically updated from a network source, such as DNS or a HTTP API.

In terms of performance, ipset can be faster than the recent module in some scenarios, particularly when dealing with large sets of IP addresses. This is because ipset uses a hash table to store the IP addresses, which allows for efficient lookups and updates.

However, the performance difference between the two tools may not be significant for small sets of IP addresses or for basic rate-limiting or firewall rules. Additionally, the choice of which tool to use ultimately depends on the specific use case and requirements.

If you need to manage a large number of IP addresses or other network objects, or if you need to dynamically update the sets based on external sources, ipset may be a better choice. On the other hand, if you only need to track and limit traffic from a specific IP address or port, the recent module may be sufficient.

FYI recent uses linked list.


  • Great explanation!
    – pugmarx
    Commented Mar 3, 2023 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .