This patch adds a new match called 'hashlimit'. The idea is to have something like 'limit', but either per destination-ip or per (destip,destport) tuple. It gives you the ability to express

     '1000 packets per second for every host in 192.168.0.0/16'

     '100 packets per second for every service of 192.168.1.1'

with a single iptables rule.

--hashlimit rate
    A rate just like the limit match

--hashlimit-burst num
    Burst value, just like limit match

--hashlimit-mode destip | destip-destport
    Limit per IP or per port

--hashlimit-name foo
    The name for the /proc/net/ipt_hashlimit/foo entry

--hashlimit-htable-size num
    The number of buckets of the hash table

--hashlimit-htable-max num
    Maximum entries in the hash

--hashlimit-htable-expire num
    After how many miliseconds do hash entries expire

--hashlimit-htable-gcinterval num
    How many miliseconds between garbage collection intervals