I run the following iptables commands to detect and log a port scan:iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --setiptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -j LOG --log-prefix Port Scan on INPUT: iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --setiptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 20 -j LOG --log-prefix Port Scan on FORWARD: And this works great! However, when I run a port scan on all 65535 ports, my log file grows by 33 megabytes. This is because iptables will log once after the 20th new port connection and every other connection after that. What type of command would I have to run to log only after the first 20 connections were made or every time 20 connections are made?
iptables LOG only once
linux;security;iptables;logs;nmap