Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 27 Jan 2000 15:26:51 +0100 (CET)
From:      Luigi Rizzo <luigi@info.iet.unipi.it>
To:        ROGIER MULHUIJZEN <MULHUIJZEN@PZH.NL>
Cc:        sameh@fr.clara.net, scrappy@hub.org, freebsd-stable@FreeBSD.ORG
Subject:   Re: icmp-response bandwidth limit 103/100 pps
Message-ID:  <200001271426.PAA17562@info.iet.unipi.it>
In-Reply-To: <s8906027.037@smtp.pzh.nl> from ROGIER MULHUIJZEN at "Jan 27, 2000 03:11:02 pm"

next in thread | previous in thread | raw e-mail | index | archive | help
> >remove the line:
> >options		ICMP_BANDLIM
> 
> Might be a bit drastic. You could use

of course

	ipfw add 100 pipe 10 icmp from any to any
	ipfw pipe 10 config bw 10Kbit/s queue 20

is also a nice way to limit icmp traffic.

Furthermore, with the new 
version of dumminet (in -current/-stable) you can also do

	ipfw pipe 10 config mask src-ip 0xffffffff dst-ip 0xffffffff \
		 bw 10Kbit/s queue 20

so you see where the icmp traffic is coming from/going to
(of course the source address can be easily spoofed).

I had to do this just yesterday night as our net was flooded by an
icmp storm saturating our link to the outside.  I have a bridge-firewall
in the middle of our link right for this kind of traffic
filtering/analysis...

	# ipfw show
	00090 2765865 2965788663 deny icmp from any to XXX.XXX.XXX.XXX


	cheers
	luigi
-----------------------------------+-------------------------------------
  Luigi RIZZO, luigi@iet.unipi.it  . Dip. di Ing. dell'Informazione
  http://www.iet.unipi.it/~luigi/  . Universita` di Pisa
  TEL/FAX: +39-050-568.533/522     . via Diotisalvi 2, 56126 PISA (Italy)
  Mobile   +39-347-0373137
-----------------------------------+-------------------------------------


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001271426.PAA17562>