Icmp Rate-Limiting - ProCurve 6200yl Management And Configuration Manual

Port Traffic Controls
Rate-Limiting
C a u t i o n
N o t e
13-10

ICMP Rate-Limiting

In IP networks, ICMP (Internet Control Message Protocol) messages are
generated in response to either inquiries or requests from routing and diag-
nostic functions. These messages are directed to the applications originating
the inquiries. In unusual situations, if the messages are generated rapidly with
the intent of overloading network circuits, they can threaten network avail-
ability. This problem is visible in denial-of-service (DoS) attacks or other
malicious behaviors where a worm or virus overloads the network with ICMP
messages to an extent where no other traffic can get through. (ICMP messages
themselves can also be misused as virus carriers). Such malicious misuses of
ICMP can include a high number of ping packets that mimic a valid source IP
address and an invalid destination IP address (spoofed pings), and a high
number of response messages (such as Destination Unreachable error mes-
sages) generated by the network.
ICMP rate-limiting provides a method for limiting the amount of bandwidth
that may be utilized for inbound ICMP traffic on a switch port or trunk. This
feature allows users to restrict ICMP traffic to percentage levels that permit
necessary ICMP functions, but throttle additional traffic that may be due to
worms or viruses (reducing their spread and effect). In addition, ICMP
rate-limiting preserves inbound port bandwidth for non-ICMP traffic.
The ICMP protocol is necessary for routing, diagnostic, and error responses
in an IP network. ICMP rate-limiting is primarily used for throttling worm or
virus-like behavior, and should normally be configured to allow one to five per
cent of available inbound bandwidth to be used for ICMP traffic. This feature
should not be used to remove all ICMP traffic from a network.
ICMP rate-limiting does not throttle non-ICMP traffic. In cases where you want
to throttle both ICMP traffic and all other inbound traffic on a given interface,
you can separately configure both ICMP rate-limiting and all-traffic rate-
limiting.
Beginning with software release K.12.xx or later, the all-traffic rate-limiting
command (rate-limit all) and the ICMP rate-limiting command (rate-limit icmp)
operate differently:
• All traffic rate-limiting applies to both inbound and outbound traffic,
and can be specified either in terms of a percentage of total bandwidth
or in terms of bits per second;
• ICMP rate-limiting applies only to inbound traffic, and can only be
specified as a percentage of total bandwidth.