Icmp Rate-Limiting Trap And Event Log Messages - ProCurve 6200yl Management And Configuration Manual

Note on Testing
ICMP Rate-Limiting
because the total traffic load requested to the outbound interface exceeds
the interface's bandwidth, and thus some requested traffic may be held
off on inbound.
■ Monitoring (Mirroring) ICMP rate-limited interfaces: If monitoring
is configured, packets dropped by ICMP rate-limiting on a monitored
interface will still be forwarded to the designated monitor port.
(Monitoring shows what traffic is inbound on an interface, and is not
affected by "drop" or "forward" decisions.)
Optimum rate-limiting operation: Optimum rate-limiting occurs with
■
64-byte packet sizes. Traffic with larger packet sizes can result in
performance somewhat below the configured inbound bandwidth. This is
to ensure the strictest possible rate-limiting of all sizes of packets.
■ Outbound Traffic Flow: Configuring ICMP rate-limiting on an interface
does not control the rate of outbound traffic flow on the interface.
ICMP rate-limiting is applied to the available bandwidth on an interface. If the
total bandwidth requested by all ICMP traffic is less than the available,
configured maximum rate, then no ICMP rate-limit can be applied. That is, an
interface must be receiving more inbound ICMP traffic than the configured
bandwidth limit allows. If the interface is configured with both rate-limit all
and rate-limit icmp, then the ICMP limit can be met or exceeded only if the rate
limit for all types of inbound traffic has not already been met or exceeded.
Also, to test the ICMP limit it is necessary to generate ICMP traffic that exceeds
the configured ICMP rate limit. Using the recommended settings—1% for edge
interfaces and 5% maximum for core interfaces—it is easy to generate suffi-
cient traffic. However, if you are testing with higher maximums, it is necessary
to ensure that the ICMP traffic volume exceeds the configured maximum.
Note also that testing ICMP rate-limiting where inbound ICMP traffic on a
given interface has destinations on multiple outbound interfaces, the test
results must be based on the received outbound ICMP traffic.
ICMP rate-limiting is not reflected in counters monitoring inbound traffic
because inbound packets are counted before the ICMP rate-limiting drop
action occurs.

ICMP Rate-Limiting Trap and Event Log Messages

If the switch detects a volume of inbound ICMP traffic on a port that exceeds
the ICMP rate-limit configured for that port, it generates one SNMP trap and
one informational Event Log message to notify the system operator of the
condition. (The trap and Event Log message are sent within two minutes of
when the event occurred on the port.)
Port Traffic Controls
Rate-Limiting
13-15