From owner-freebsd-questions Thu Aug 26 20:33:44 1999 Delivered-To: freebsd-questions@freebsd.org Received: from inet.chip-web.com (c1003518-a.plstn1.sfba.home.com [24.1.82.47]) by hub.freebsd.org (Postfix) with SMTP id D179B15168 for ; Thu, 26 Aug 1999 20:33:41 -0700 (PDT) (envelope-from ludwigp@bigfoot.com) Received: (qmail 1723 invoked from network); 27 Aug 1999 03:34:02 -0000 Received: from furball.chip-web.com (HELO bigfoot.com) (172.16.1.29) by inet.chip-web.com with SMTP; 27 Aug 1999 03:34:02 -0000 Message-ID: <37C60717.3D4A0981@bigfoot.com> Date: Thu, 26 Aug 1999 20:33:43 -0700 From: Ludwig Pummer X-Mailer: Mozilla 4.61 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: TrouBle Cc: "freebsd-questions@freebsd.org" Subject: Re: Ummmm ???? HUH ?? (ICMP_BANDLIM) References: <64003B21ECCAD11185C500805F31EC0303787062@houston.matchlogic.com> <37C58FA1.37710788@hackfurby.com> <19990826145822.A7036@dan.emsphone.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Dan Nelson wrote: > It's a message saying that the system is receiving more than 100 ICMP > messages per second, and is throttling responses. This usually > indicates a ping flood. And it's first enabled by putting "options ICMP_BANDLIM" in your kernel config file. I'm not too sure that this message would pop up during a ping flood. According to comments in the source code, (/usr/src/sys/netinet/ip_icmp.c), ICMP_BANDLIM only limits ICMP _error_ responses. A ping flood could cause it if you're ping flooding a nonexistent address. But I get those messages when I'm toying around with nessus (a "security scanner") and I hit ports with nothing listening on them. --Ludwig Pummer To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message