Date: Thu, 27 Jan 2000 15:26:51 +0100 (CET) From: Luigi Rizzo <luigi@info.iet.unipi.it> To: ROGIER MULHUIJZEN <MULHUIJZEN@PZH.NL> Cc: sameh@fr.clara.net, scrappy@hub.org, freebsd-stable@FreeBSD.ORG Subject: Re: icmp-response bandwidth limit 103/100 pps Message-ID: <200001271426.PAA17562@info.iet.unipi.it> In-Reply-To: <s8906027.037@smtp.pzh.nl> from ROGIER MULHUIJZEN at "Jan 27, 2000 03:11:02 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> >remove the line: > >options ICMP_BANDLIM > > Might be a bit drastic. You could use of course ipfw add 100 pipe 10 icmp from any to any ipfw pipe 10 config bw 10Kbit/s queue 20 is also a nice way to limit icmp traffic. Furthermore, with the new version of dumminet (in -current/-stable) you can also do ipfw pipe 10 config mask src-ip 0xffffffff dst-ip 0xffffffff \ bw 10Kbit/s queue 20 so you see where the icmp traffic is coming from/going to (of course the source address can be easily spoofed). I had to do this just yesterday night as our net was flooded by an icmp storm saturating our link to the outside. I have a bridge-firewall in the middle of our link right for this kind of traffic filtering/analysis... # ipfw show 00090 2765865 2965788663 deny icmp from any to XXX.XXX.XXX.XXX cheers luigi -----------------------------------+------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . Dip. di Ing. dell'Informazione http://www.iet.unipi.it/~luigi/ . Universita` di Pisa TEL/FAX: +39-050-568.533/522 . via Diotisalvi 2, 56126 PISA (Italy) Mobile +39-347-0373137 -----------------------------------+------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001271426.PAA17562>