From owner-freebsd-net Sat Jan 20 17: 7:54 2001 Delivered-To: freebsd-net@freebsd.org Received: from silby.com (cb34181-c.mdsn1.wi.home.com [24.183.3.139]) by hub.freebsd.org (Postfix) with ESMTP id 976C437B698 for ; Sat, 20 Jan 2001 17:07:26 -0800 (PST) Received: (qmail 16569 invoked by uid 1000); 21 Jan 2001 01:07:25 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 21 Jan 2001 01:07:25 -0000 Date: Sat, 20 Jan 2001 19:07:25 -0600 (CST) From: Mike Silbersack To: Vince Vielhaber Cc: Subject: Re: icmp-response bandwidth limit? In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, 20 Jan 2001, Vince Vielhaber wrote: > Today I'm suddenly getting these messages: > > Jan 20 18:44:48 chives /kernel: icmp-response bandwidth limit 230/200 pps > > Is someone trying to pingflood me or something? > > Vince. They're either doing something that causes RSTs or icmp unreachables to be emitted, not ping flooding you. In all likelihood, it's just a portscan, and nothing to be worried about. Generally, attack tools will exceed the limit by a great deal, portscanning tools will adapt and stay close to the limited rate. There should be no need to worry, though your curiosity may drive you to use a packet sniffer next time it happens. Mike "Silby" Silbersack To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message