# [solved] detect amount of new outgoing tcp conns per port

## toralf

I'd like to be informed (but not more often than once per second) if the amount of new outgoing connections to destination port $p per second is greater than 250. The following approaches don't work as expected:

```
$IPT -A OUTPUT -p tcp --destination-port $p --syn --match connlimit --connlimit-above 250 --connlimit-mask 32 --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p "

$IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit --connlimit-above  250 --connlimit-mask 32 --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p "

$IPT -A OUTPUT -p tcp --destination-port $p --syn --match state --state NEW --match limit --limit 250/second --match limit --limit  1/second -j LOG --log-prefix "PORTMAX $p "

```

Any hints ?Last edited by toralf on Thu Aug 11, 2016 8:49 pm; edited 4 times in total

----------

## Syl20

Did you try to split the connlimit filter and the limit one into two distinct rules ?

```
$IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit ! --connlimit-above 250 --connlimit-mask 32 -j ACCEPT # or -j WHATYOUWANT

$IPT -A OUTPUT -p tcp --destination-port $p --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p "
```

Note that here, the supplemantary packets will just be logged. You may have to add another rule to accept or to drop them.

----------

## toralf

Well, I finally got it with one rule :

```
$IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match limit --limit 1/second --limit-burst 1 --match connlimit --connlimit-above $max -j LOG --log-prefix "PORTMAX $p "
```

but is this the most simple solution ?

Update

Seems to be better:

```
$IPT -A OUTPUT -p tcp --destination-port $p --match conntrack --ctstate NEW --match connlimit --connlimit-above 250 --connlimit-mask  0 --connlimit-daddr --match limit --limit 1/second --limit-burst 1 -j LOG --log-prefix "PORTMAX $p m2 "
```

----------

