Question on rate limiting on nftables

--278e88c6f2398b619962ac0a3ffc48329e3e2fb0ea2b2008d38e038e6afe
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8

Hello,

I am testing nftables SSH connections attempts limit, and I read about "met=
ers"

I would like to know the difference between these two methods of new connec=
tions limiting, and to ensure the first one is correct.

The first option:

~~~
table inet filter {
  [...]
  meta nfproto ipv4 tcp dport ssh ct state new,untracked \
  limit rate over 10/second \
  counter add @banned_ipv4 { ip saddr . ssh } \
  comment "Ban SSH bots"
}
~~~

And the second option:

~~~
table inet filter {
  [...]
  meta nfproto ipv4 tcp dport ssh ct state new,untracked \
  meter ssh4 { ip saddr limit rate over 10/second } \
  add @banned_ipv4 { ip saddr . ssh }
}
~~~

Is there any advantage using the second method ?

Thanks for your insights

--=20
=F0=9F=8C=90 https//rodier.me/

--278e88c6f2398b619962ac0a3ffc48329e3e2fb0ea2b2008d38e038e6afe
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iIYEABYKAC4WIQQgxtr4dsuCnRR2flvDkWYfWv7tQgUCaian8BAcYW5kcmVAcm9k
aWVyLm1lAAoJEMORZh9a/u1Ch4sBAMQs2TjOKY098XI9CG6iSgIYJ6EWKXLnkT2b
9LEW2HfeAP42BWmL3FvOdW7rOuZE5ZimTelte9VV2W6tHDiEJuZ+Bg==
=ICDl
-----END PGP SIGNATURE-----

--278e88c6f2398b619962ac0a3ffc48329e3e2fb0ea2b2008d38e038e6afe--