Date: Sun, 18 May 2014 00:43:40 +0800 From: bycn82 <bycn82@gmail.com> To: Freddie Cash <fjwcash@gmail.com> Cc: "freebsd-ipfw@freebsd.org" <freebsd-ipfw@freebsd.org> Subject: Re: feature of `packet per second` Message-ID: <537791BC.7090209@gmail.com> In-Reply-To: <CAOjFWZ4zRUmcjG-r--OqoGEWcSZoWhtTykgAAHzCjoEWsMVS9g@mail.gmail.com> References: <5360F1F4.9060808@gmail.com> <5361105C.1040203@freebsd.org> <53611738.8010103@gmail.com> <CAOjFWZ4zRUmcjG-r--OqoGEWcSZoWhtTykgAAHzCjoEWsMVS9g@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 4/30/14 23:45, Freddie Cash wrote: > On Wed, Apr 30, 2014 at 8:31 AM, bycn82 <bycn82@gmail.com > <mailto:bycn82@gmail.com>>wrote: > > On 4/30/14 23:01, Julian Elischer wrote: > > On 4/30/14, 8:52 PM, bycn82 wrote: > > Hi > > `packet per second` it is easy to be implemented using > iptables, there is a module named `recent`, but in using > ipfw, Do we have any solution to fulfill it? check the > link below > https://forums.freebsd.org/viewtopic.php?f=44&t=42933&p=258441#p258441 > <https://forums.freebsd.org/viewtopic.php?f=44&t=42933&p=258441#p258441>; > > > since I don't use linux.. what is "packet per second"?.. does > it report it or set a limit on it? > > > bycn82 > > _______________________________________________ > freebsd-ipfw@freebsd.org <mailto:freebsd-ipfw@freebsd.org> > mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to > "freebsd-ipfw-unsubscribe@freebsd.org > <mailto:freebsd-ipfw-unsubscribe@freebsd.org>" > > > > > Yes, "Packets Per Second"means limit a connection based on the > packets number, for example, If I allow 2 ICMP packets come to my > server in each individual second. only the first 2 packets will > be allow, all others in the same second will be dropped. > > > For ICMP, specifically, there's a sysctl to control the rate (per > second): > > # sysctl -d net.inet.icmp.icmplim > net.inet.icmp.icmplim: Maximum number of ICMP responses per second > > > For everything else, you'd want to use dummynet(4). > > -- > Freddie Cash > fjwcash@gmail.com <mailto:fjwcash@gmail.com> Hi As Freddie said, for ICMP protocal, actually it comes with this 'PPS' feature. So I just double checked the source code of ip_icmp.c file because I dont know this before. And suddenly a question came into my mind. "Why I dont know it before" Yes, I can list down all the sysctl option by `sysctl -a` command, But we dont have any page which introduced all the options, root@FB10Head:~ # sysctl -a | grep rexmit_min net.inet.tcp.rexmit_min: 30 root@FB10Head:~ # sysctl -a | grep icmplim net.inet.icmp.icmplim: 200 net.inet.icmp.icmplim_output: 1 root@FB10Head:~ # sysctl -a | wc -l 4120 root@FB10Head:~ # So, more than 4000 options!!! Maybe we should have mail-list to collect the introduction of all the options or a public WiKi page like wikipedia for it. Regards, bycn82
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?537791BC.7090209>