From owner-freebsd-stable Thu Jan 27 6:27:53 2000 Delivered-To: freebsd-stable@freebsd.org Received: from info.iet.unipi.it (info.iet.unipi.it [131.114.9.184]) by hub.freebsd.org (Postfix) with ESMTP id 8E56A154B2 for ; Thu, 27 Jan 2000 06:27:42 -0800 (PST) (envelope-from luigi@info.iet.unipi.it) Received: (from luigi@localhost) by info.iet.unipi.it (8.9.3/8.9.3) id PAA17562; Thu, 27 Jan 2000 15:26:51 +0100 (CET) (envelope-from luigi) From: Luigi Rizzo Message-Id: <200001271426.PAA17562@info.iet.unipi.it> Subject: Re: icmp-response bandwidth limit 103/100 pps In-Reply-To: from ROGIER MULHUIJZEN at "Jan 27, 2000 03:11:02 pm" To: ROGIER MULHUIJZEN Date: Thu, 27 Jan 2000 15:26:51 +0100 (CET) Cc: sameh@fr.clara.net, scrappy@hub.org, freebsd-stable@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL61 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > >remove the line: > >options ICMP_BANDLIM > > Might be a bit drastic. You could use of course ipfw add 100 pipe 10 icmp from any to any ipfw pipe 10 config bw 10Kbit/s queue 20 is also a nice way to limit icmp traffic. Furthermore, with the new version of dumminet (in -current/-stable) you can also do ipfw pipe 10 config mask src-ip 0xffffffff dst-ip 0xffffffff \ bw 10Kbit/s queue 20 so you see where the icmp traffic is coming from/going to (of course the source address can be easily spoofed). I had to do this just yesterday night as our net was flooded by an icmp storm saturating our link to the outside. I have a bridge-firewall in the middle of our link right for this kind of traffic filtering/analysis... # ipfw show 00090 2765865 2965788663 deny icmp from any to XXX.XXX.XXX.XXX cheers luigi -----------------------------------+------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . Dip. di Ing. dell'Informazione http://www.iet.unipi.it/~luigi/ . Universita` di Pisa TEL/FAX: +39-050-568.533/522 . via Diotisalvi 2, 56126 PISA (Italy) Mobile +39-347-0373137 -----------------------------------+------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message