I'm having a FreeBSD router here that has many networks connected to it which are only sparsely populated. These days I get network scans (deliberate and worms scanning for new targets) every second or so going through every IP in my netblocks. The router is faithfully generating ICMP host unreachable replies to all these scans for each and every unreachable destination IP.
I wonder whether it is justifyable to rate limit the icmp host unreachable replies just like the other icmp stuff to 200 (default) per second? Should help alot if the next SQL slammer is coming around and you get thousands of packets per second for unreachable destinations.
Comments and opinions welcome!
PS: I've already coded it and it works nicely.
-- Andre
_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
