From owner-freebsd-questions@FreeBSD.ORG  Sat May 14 07:35:52 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 8D03A16A4CE
	for <freebsd-questions@freebsd.org>;
	Sat, 14 May 2005 07:35:52 +0000 (GMT)
Received: from pne-smtpout1-sn1.fre.skanova.net
	(pne-smtpout1-sn1.fre.skanova.net [81.228.11.98])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A58D943D76
	for <freebsd-questions@freebsd.org>;
	Sat, 14 May 2005 07:35:51 +0000 (GMT)
	(envelope-from ertr1013@student.uu.se)
Received: from falcon.midgard.homeip.net (212.181.162.201) by
	pne-smtpout1-sn1.fre.skanova.net (7.1.026.7)
	id 42650A3B0064D8C9 for freebsd-questions@freebsd.org;
	Sat, 14 May 2005 09:35:50 +0200
Received: (qmail 96157 invoked by uid 1001); 14 May 2005 07:35:49 -0000
Date: Sat, 14 May 2005 09:35:48 +0200
From: Erik Trulsson <ertr1013@student.uu.se>
To: "Colin J. Raven" <colin@kenmore.kozy-kabin.nl>
Message-ID: <20050514073548.GA96049@falcon.midgard.homeip.net>
Mail-Followup-To: "Colin J. Raven" <colin@kenmore.kozy-kabin.nl>,
	FreeBSD Questions <freebsd-questions@freebsd.org>
References: <20050514090844.Q9329@kenmore.kozy-kabin.nl>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050514090844.Q9329@kenmore.kozy-kabin.nl>
User-Agent: Mutt/1.5.9i
cc: FreeBSD Questions <freebsd-questions@freebsd.org>
Subject: Re: Strange kernel messages
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 14 May 2005 07:35:52 -0000

On Sat, May 14, 2005 at 09:14:20AM +0200, Colin J. Raven wrote:
> Hi all!
> I occasionally get these in my daily security run output (which is 
> worrying in itself)
> 
> Limiting closed port RST response from 1629 to 200 packets per second
> 
> the number of these can range from one or two, to sometimes 25 - 30 
> although the latter case is rarer. Usually there's about six or so. 
> These don't arrive every day, usually about once per week on average.
> 
> Is this an OS response to an attempted attack, limiting potential DDOS 
> damage? That's how I'm reading it, but of course I'm guessing. If that 
> *is* so, what mechanism is doing this?
> 
> FreeBSD 4.11 STABLE


See the FAQ:
http://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/networking.html#ICMP-RESPONSE-BW-LIMIT




-- 
<Insert your favourite quote here.>
Erik Trulsson
ertr1013@student.uu.se