feature of `packet per second`

[bycn82]

On 4/30/14 23:45, Freddie Cash wrote:
> On Wed, Apr 30, 2014 at 8:31 AM, bycn82 <bycn82 at gmail.com 
> <mailto:bycn82 at gmail.com>>wrote:
>
>     On 4/30/14 23:01, Julian Elischer wrote:
>
>         On 4/30/14, 8:52 PM, bycn82 wrote:
>
>             Hi
>
>             `packet per second` it is easy to be implemented using
>             iptables, there is a module named `recent`, but in using
>             ipfw, Do we have any solution to fulfill it? check the
>             link below
>             https://forums.freebsd.org/viewtopic.php?f=44&t=42933&p=258441#p258441
>             <https://forums.freebsd.org/viewtopic.php?f=44&t=42933&p=258441#p258441>
>
>
>         since I don't use linux.. what is "packet per second"?.. does
>         it report it or set a limit on it?
>
>
>              bycn82
>
>             _______________________________________________
>             freebsd-ipfw at freebsd.org <mailto:freebsd-ipfw at freebsd.org>
>             mailing list
>             http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
>             To unsubscribe, send any mail to
>             "freebsd-ipfw-unsubscribe at freebsd.org
>             <mailto:freebsd-ipfw-unsubscribe at freebsd.org>"
>
>
>
>
>     Yes, "Packets Per Second"means limit a connection based on the
>     packets number, for example, If I allow 2 ICMP packets come to my
>     server in each individual second.  only the first 2 packets will
>     be allow, all others in the same second will be dropped.
>
>
> ​For ICMP, specifically, there's a sysctl to control the rate (per 
> second):
>
> # sysctl -d ​net.inet.icmp.icmplim
> net.inet.icmp.icmplim: Maximum number of ICMP responses per second
>
>
> For everything else, you'd want to use dummynet(4).
>
> -- 
> Freddie Cash
> fjwcash at gmail.com <mailto:fjwcash at gmail.com>
Thanks for your reply,  and it is good to know the sysctl for ICMP.

finally it works.I just added a new `action` in firewall and it is 
called `pps`,  that means it can be generic purpose while the 
net.inet.icmp.icmplim is only for ICMP traffic.

the usage will be like below

root at F10:/usr/src/sbin/ipfw # .*/ipfw add pps 1 icmp from any to any*
00100 pps 1 icmp from any to any
root at F10:/usr/src/sbin/ipfw # ./ipfw show
00100     9     540 pps 1 icmp from any to any
65535 13319 1958894 allow ip from any to any
root at F10:/usr/src/sbin/ipfw #

regards,
bycn82