ICMP Unreachable Rate Limiting
DDTS CSCdp28161 added an ICMP Unreachable rate-limiting feature in IOS Software Release 12.0(8)S. This feature is turned on by default and is not seen in the CLI unless the default rate limit is changed. This feature rate limits the router's responses to ICMP Unreachable messages leaving the router. The objective is to keep the router from being overwhelmed with an ICMP Unreachable overload (that is, a DoS attack against the router). By default, the router rate limits ICMP Unreachables to one per 500 milliseconds. Before IOS Software Release 12.0(8)S, this was not configurable. Now many ISPs can set the routers to respond to one ICMP Unreachable every 2000 ms, providing greater resistance to an ICMP Unreachable overload.
A new global command is introduced to control the ICMP Unreachable rate. This command is hidden unless the defaults are changed. The default is to have one ICMP Unreachable message per 500 ms.
ip icmp rate-limit unreachable [DF] 1-4294967295 no ip icmp rate-limit unreachable [DF]
The DF option rate limits the ICMP Unreachable message with code 4, fragmentation needed, and DF set.
Consultation with several ISPs resulted in the recommendation that ISPs should set this rate limit to one every two seconds. For example, the following example sets the rate of the ICMP Unreachable to one message per 2000 ms with DF set:
ip icmp rate-limit unreachable DF 2000
Continue reading here: No IP Unreachables
Was this article helpful?