From owner-freebsd-net@FreeBSD.ORG Thu Jan 22 11:03:04 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8D28216A4CE for ; Thu, 22 Jan 2004 11:03:04 -0800 (PST) Received: from relay.pair.com (relay.pair.com [209.68.1.20]) by mx1.FreeBSD.org (Postfix) with SMTP id 8C13943D2F for ; Thu, 22 Jan 2004 11:03:02 -0800 (PST) (envelope-from silby@silby.com) Received: (qmail 39267 invoked from network); 22 Jan 2004 19:03:01 -0000 Received: from niwun.pair.com (HELO localhost) (209.68.2.70) by relay.pair.com with SMTP; 22 Jan 2004 19:03:01 -0000 X-pair-Authenticated: 209.68.2.70 Date: Thu, 22 Jan 2004 13:02:59 -0600 (CST) From: Mike Silbersack To: Andre Oppermann In-Reply-To: <4010165F.2080507@freebsd.org> Message-ID: <20040122130156.N7234@odysseus.silby.com> References: <4010165F.2080507@freebsd.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-net@freebsd.org Subject: Re: Rate limiting icmp host unreachable replies? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Jan 2004 19:03:04 -0000 On Thu, 22 Jan 2004, Andre Oppermann wrote: > I'm having a FreeBSD router here that has many networks connected to it which > are only sparsely populated. These days I get network scans (deliberate and > worms scanning for new targets) every second or so going through every IP in > my netblocks. The router is faithfully generating ICMP host unreachable replies > to all these scans for each and every unreachable destination IP. > > I wonder whether it is justifyable to rate limit the icmp host unreachable replies > just like the other icmp stuff to 200 (default) per second? Should help alot if > the next SQL slammer is coming around and you get thousands of packets per second > for unreachable destinations. > > Comments and opinions welcome! I like this a lot, and I would be willing to write up an implementation! > PS: I've already coded it and it works nicely. > > -- > Andre Doh! Well, I guess we'll just have to go with your implementation then. :) Mike "Silby" Silbersack