Chain INPUT (policy DROP)
target     prot opt source               destination
level2     all  --  192.168.11.222       anywhere
level3     all  --  192.168.16.179       anywhere
level3     all  --  192.168.16.21        anywhere
level3     all  --  192.168.11.1         anywhere
level3     all  --  192.168.11.138       anywhere
level3     all  --  192.168.11.197       anywhere
level3     all  --  192.168.11.129       anywhere
ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
level2     all  --  192.168.11.222       anywhere
level3     all  --  192.168.16.179       anywhere
level3     all  --  192.168.16.21        anywhere
level3     all  --  192.168.11.1         anywhere
level3     all  --  192.168.11.138       anywhere
level3     all  --  192.168.11.197       anywhere
level3     all  --  192.168.11.129       anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain level0 (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain level1 (0 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Chain level2 (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            limit: avg 50/sec burst 5
DROP       all  --  anywhere             anywhere

Chain level3 (12 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            limit: avg 151/sec burst 5
DROP       all  --  anywhere             anywhere

NOTE: This router shows both the 16.X and 11.X subnets as limited. this
router is getting hit by both subnets in the attack.