Rate limiting icmp host unreachable replies?

Andre Oppermann andre at freebsd.org
Thu Jan 22 10:28:50 PST 2004

I'm having a FreeBSD router here that has many networks connected to it which
are only sparsely populated.  These days I get network scans (deliberate and
worms scanning for new targets) every second or so going through every IP in
my netblocks.  The router is faithfully generating ICMP host unreachable replies
to all these scans for each and every unreachable destination IP.

I wonder whether it is justifyable to rate limit the icmp host unreachable replies
just like the other icmp stuff to 200 (default) per second?  Should help alot if
the next SQL slammer is coming around and you get thousands of packets per second
for unreachable destinations.

Comments and opinions welcome!

PS: I've already coded it and it works nicely.


More information about the freebsd-net mailing list