13-11
Port Traffic Controls
Rate-Limiting
messages to an extent where no other traffic can get through. (ICMP messages
themselves can also be misused as virus carriers). Such malicious misuses of
ICMP can include a high number of ping packets that mimic a valid source IP
address and an invalid destination IP address (spoofed pings), and a high
number of response messages (such as Destination Unreachable error mes-
sages) generated by the network.
ICMP rate-limiting provides a method for limiting the amount of bandwidth
that may be utilized for inbound ICMP traffic on a switch port or trunk. This
feature allows users to restrict ICMP traffic to percentage levels that permit
necessary ICMP functions, but throttle additional traffic that may be due to
worms or viruses (reducing their spread and effect). In addition, ICMP
rate-limiting preserves inbound port bandwidth for non-ICMP traffic.
C a u t i o n
The ICMP protocol is necessary for routing, diagnostic, and error responses
in an IP network. ICMP rate-limiting is primarily used for throttling worm or
virus-like behavior, and should normally be configured to allow one to five per
cent of available inbound bandwidth (at 10 Mbps or 100 Mbps speeds) or 100
- 10,000 kbps (1Gbps or 10 Gbps speeds) to be used for ICMP traffic.
This
feature should not be used to remove all ICMP traffic from a network
.
N o t e
ICMP rate-limiting does not throttle non-ICMP traffic. In cases where you want
to throttle both ICMP traffic and all other inbound traffic on a given interface,
you can separately configure both ICMP rate-limiting and all-traffic rate-
limiting.
Beginning with software release K.12.
xx
or later, the all-traffic rate-limiting
command (
rate-limit all)
and the ICMP rate-limiting command (
rate-limit icmp
)
operate differently:
•
All traffic rate-limiting applies to both inbound and outbound traffic,
and can be specified either in terms of a percentage of total bandwidth
or in terms of bits per second;
•
ICMP rate-limiting applies only to inbound traffic, and can only be
specified as a percentage of total bandwidth.
Terminology
All-Traffic Rate-Limiting:
Applies a rate-limit to all traffic (including ICMP
traffic) on an interface. For details, see “Rate-Limiting” on page 13-4.
ICMP Rate-Limiting:
Applies a rate-limit to all
inbound
ICMP traffic
received on an interface, but does not limit other types of inbound traffic.
3500-5400-6200-8200-MCG-Jan08-K_13_01.book Page 11 Monday, January 28, 2008 10:04 AM