Date: Wed, 5 Apr 2000 11:58:52 -0700 (PDT) From: Doug Barton <Doug@gorean.org> To: Omachonu Ogali <oogali@intranova.net> Cc: Pete Fritchman <petef@binary.databits.net>, freebsd-questions@freebsd.org Subject: Re: icmp-response bandwidth limit question Message-ID: <Pine.BSF.4.21.0004051155540.24259-100000@dt051n0b.san.rr.com> In-Reply-To: <Pine.BSF.4.10.10004041607550.93547-100000@hydrant.intranova.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 4 Apr 2000, Omachonu Ogali wrote:
> On Mon, 3 Apr 2000, Doug Barton wrote:
>
> > Pete Fritchman wrote:
> > >
> > > > icmp-response bandwidth limit 734/200 pps
> > > > icmp-response bandwidth limit 729/200 pps
> > >
> > > What do these indicate?
> >
> > That your kernel is dropping everything over 200 ICMP packets per
> > second.
>
> It indicates that your kernel is dropping ICMP and/or TCP responses that
> are coming out faster than 200 packets per second. It's limiting what's
> coming OUT from you.
This option does not affect TCP responses. It's ICMP only.
> In this case, someone may have
> been port scanning your machine and the kernel was eliciting RST's or ICMP
> unreachables in return to non-open ports, and at the rate it was being
> output it triggered ICMP response limiting.
That's possible, true. Although if they have a semi-decent
firewall it shouldn't be allowing this type of port scanning activity. Of
course, he didn't think his firewall would let through ICMP either...
Doug
--
"So, the cows were part of a dream that dreamed itself into
existence? Is that possible?" asked the student incredulously.
The master simply replied, "Mu."
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0004051155540.24259-100000>