How to reject a connection with 10 or more TTL 58 requests?

Question

iptables

I welcome everyone. There is one exploit, after analyzing tcpdump, I came to the conclusion that absolutely always, TTL = 58.
The question arose whether it is possible to reject such a client using iptables and not process its requests with 10 requests, for example, in 5 seconds with a value of ttl = 58 Tell me if there are experts in this.

Answer 1

You set ipset (probably already installed) and add the list:
sudo ipset -N BANNED_IP nethash
Add rules:

# Отбрасываем пакет если TTL 58 и IP есть в списке BANNED_IP
sudo iptables -A INPUT -m ttl --ttl-eq 58 -m set --match-set BANNED_IP src -j DROP

# Надо как-то добавлять IP отвечающие критериям в список BANNED_IP, для этого
# Добавляем кастомную цепочку RATE-LIMIT
sudo iptables -N RATE-LIMIT

# Если TTL 58 передаём пакет на обработку в цепочку RATE-LIMIT
sudo iptables -A INPUT -m ttl --ttl-eq 58 -j RATE-LIMIT

# Если количество пакетов не превышает 2 в секунду, то пропускаем
sudo iptables -A RATE-LIMIT -m limit --limit 2/second -j ACCEPT

# Когда лимит превышен добавляем в лог запись об этом событии
sudo iptables -A RATE-LIMIT -j LOG --log-prefix "LIMIT_EXCEEDED: "

# Затем добавляем IP в список BANNED_IP
sudo iptables -A RATE-LIMIT -m ttl --ttl-eq 58 -j SET --add-set BANNED_IP src

# Не обязательно, но отбрасываем пакет
sudo iptables -A RATE-LIMIT -j DROP

See who got caught sudo ipset list BANNED_IP
Remove from the list if necessary sudo ipset del BANNED_IP <Забаненый IP>
Check what works sudo ping -i 0,1 -t 58 <IP сервера>
View the log tail -F /var/log/syslog | grep LIMIT_EXCEEDED
Or so dmesg | tail | grep LIMIT_EXCEEDED
PS
Just don't ban yourself. Make sure that in any case you can connect to the server via IPMI or by being physically present next to it with a monitor and keyboard.

Answer 2

5 seconds will not work, maximum - 10 pieces counted and rejected