From owner-freebsd-security  Mon Apr 15  7:21:54 2002
Delivered-To: freebsd-security@freebsd.org
Received: from www.kpi.com.au (www.kpi.com.au [203.39.132.210])
	by hub.freebsd.org (Postfix) with ESMTP id 0F30237B419
	for <freebsd-security@FreeBSD.ORG>; Mon, 15 Apr 2002 07:21:38 -0700 (PDT)
Received: from kpi.com.au (localhost.kpi.com.au [127.0.0.1])
	by www.kpi.com.au (8.9.3/8.9.3) with ESMTP id AAA67508;
	Tue, 16 Apr 2002 00:20:19 +1000 (EST)
	(envelope-from johnsa@kpi.com.au)
Message-ID: <3CBAE191.9010200@kpi.com.au>
Date: Tue, 16 Apr 2002 00:20:01 +1000
From: Andrew Johns <johnsa@kpi.com.au>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:0.9.4) Gecko/20011128 Netscape6/6.2.1
X-Accept-Language: en-gb
MIME-Version: 1.0
To: Sheldon Hearn <sheldonh@starjuice.net>
Cc: Christoph Kukulies <kuku@gilberto.physik.rwth-aachen.de>,
	freebsd-security@FreeBSD.ORG
Subject: Re: Limiting closed port RST response from 381 to 200 p
References: <12776.1018878075@axl.seasidesoftware.co.za>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Sheldon Hearn wrote:

> 
> You lose the "severity at a glance" value of the messages this way, but

> I don't find them useful enough to warrant the mess in
> /var/log/messages.
> 
> Ciao,
> Sheldon.
> 
> Index: ip_icmp.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/netinet/ip_icmp.c,v
> retrieving revision 1.39.2.16
> diff -u -d -r1.39.2.16 ip_icmp.c
> --- ip_icmp.c	22 Mar 2002 16:54:18 -0000	1.39.2.16
> +++ ip_icmp.c	15 Apr 2002 13:39:53 -0000
> @@ -862,9 +862,8 @@
>  
>  	if ((unsigned int)dticks > hz) {
>             if (lpackets[which] > icmplim) {

> -                printf("%s from %d to %d packets per second\n",

> +                printf("%s to %d packets per second\n",

>  				bandlimittype[which],
> -				lpackets[which],
>  				icmplim
>  			);
>  		}


Actually Sheldon I think that's a great idea - helps with
syslog DoS somewhat as well.  Anybody else care to contemplate
making it either a default or sysctl (ICMP_BANDLIMIT_DOSLIMIT?)

AJ


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message