Rate Limit Filter Action
This chapter provides information about Rate Limit Filter Action.
Topics in this chapter include:
Applicability
This chapter is applicable to SR OS routers and is based on SR OS Release 24.3.R1.
Overview
Filter-based rate limiting can be used by operators for security reasons to protect their network resources or mitigate DDoS attacks; see Filter Based Rate Limiting.
SR OS supports filter-based rate limiting on ingress (SR OS Release 14.0.R1) and on egress (SR OS Release 14.0.R4) for IPv4, IPv6, and MAC filter policies
The rate-limit value is configurable in kilobits per second and applicable to traffic matching the filter condition. Packets matching the filter condition are dropped when the traffic rate is above the configured policer rate value and forwarded when the traffic rate is below the configured policer rate value.
QoS Interaction
On ingress, if the MAC or IPv4/IPv6 filter action indicates that traffic must be rate limited, this traffic is redirected to a rate-limiting filter policer before delivery to the switching fabric. Traffic not matching the MAC or IP filter will pass through the regular packet processing chain, and can be limited through SAP-ingress policies. Control traffic that is extracted to the CPM is not rate limited. Rate-limiting filter policies can coexist with the cflowd, log, and mirror features.
On egress, control and data traffic matching an egress rate-limiting filter policy bypasses egress QoS policing, but the usual egress QoS queueing still applies.
Rate-Limiting with Single or Multiple FlexPaths
Filter-based rate limiting can be applied to Layer 2 and Layer 3 services, and is supported on following items, including but not limited to:
SAPs
Network interface
Spoke-SDPs
group interfaces
ESM subscribers
Filter-based rate limiting can also be used when the underlying infrastructure uses link aggregation.
If multiple interfaces use the same rate-limiting filter policy on the same FP, the system will allocate a single rate-limiter resource to the FP; a common aggregate rate limit is applied to those interfaces.
If multiple interfaces use the same rate-limiting filter policy on different FPs, the system will allocate a rate-limiter resource for each FP; an independent rate limit applies to each FP.
The example to the left in Rate Limit Filters and FlexPaths has two interfaces with the same filter applied, and terminated on the same FP. Therefore, there is only one policer, and the aggregate traffic is topped at the rate defined in the filter. The example to the right has two interfaces with different filters, again terminated on the same FP. Because the interfaces have distinct filters, two different rate-limiting policers are created, which could (but not necessarily) define the same rate.
The actual packet length is used for the rate limit, not factoring in the encapsulation.
Use caution when applying filter-based rate limiting to SAPs on group interfaces, because group interfaces can host many ESM subscribers, which could defeat per-subscriber and per-ESM host rate limiting.
Syntax
The following syntax defines an IPv4/IPv6 filter or a MAC filter with rate-limiting action:
# on PE-1:
*A:PE-1>config>filter# info
----------------------------------------------
ip-filter|ipv6-filter|mac-filter <filter-id> name <filter-name> create
default-action forward|drop
description "<filter-description>"
entry <entry-id> create
match
** match criteria, e.g.: IP/Port/MAC **
exit
action
rate-limit <value-Kbps>|max
exit
exit
exitAll regular IP and MAC match criteria are supported with the action rate-limit.
Configuration
Example Configuration shows the example configuration. Traffic is sourced on Tester T1, port //8/1, passes through VPRN 1, and is received on port //8/5 of Tester T2.
Ingress IPv4 filtering applies at the ingress SAP in VPRN 1. Ingress IPv6 filtering and ingress MAC filtering are similar to ingress IPv4 filtering and are not shown in this chapter.
The configuration of VPRN 1 on PE-1 is as follows:
# on PE-1:
configure
service
vprn 1 name "VPRN 1" customer 1 create
description "rate limit action for ip filter"
interface "int-TST-source" create
address 10.10.1.1/24
sap 1/1/c18/1 create
ingress
filter ip 3
exit
no shutdown
exit
exit
interface "int-TST-receiver" create
address 10.10.2.1/24
sap 1/1/c20/1 create
exit
exit
bgp-ipvpn
mpls
route-distinguisher 65536:1
no shutdown
exit
exit
no shutdown
exitThe filter configuration is as follows:
# on PE-1:
configure
filter
ip-filter 3 name "ip-filter-1M" create
default-action forward
description "IP filter test for rate limit action"
entry 10 create
match
dst-ip 10.10.2.2/32
src-ip 10.10.1.2/32
exit
action
rate-limit 1024 # in Kbps ; 1024000/8/128 = 1000 packets/s
exit
exit
exitA stream of UDP packets with a fixed size of 128 bytes is sent out of Tester T1 at a rate of 500 packets/s, accounting for a data rate of 500 x 128 x 8 = 512Kbit/s. At this rate, all packets pass through because the actual rate is lower than the rate-limit 1024Kbit/s, as follows:
*A:PE-1# monitor filter ip 3 entry 10 rate repeat 6 interval 11
===============================================================================
Monitor statistics for IP filter 3 entry 10
===============================================================================
-------------------------------------------------------------------------------
At time t = 0 sec (Base Statistics)
-------------------------------------------------------------------------------
Ing. Matches : 1 pkts (128 bytes)
Egr. Matches : 0 pkts
Ing. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
Egr. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
-------------------------------------------------------------------------------
At time t = 11 sec (Mode: Rate)
-------------------------------------------------------------------------------
Ing. Matches : 500 pkts (63977 bytes)
Egr. Matches : 0 pkts
Ing. Rate-limiter
Offered : 500 pkts (63988 bytes)
Forwarded : 500 pkts (63988 bytes)
Dropped : 0 pkts
Egr. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
---snip---*A:PE-1# monitor filter ip 3 entry 10 rate repeat 6 interval 11
===============================================================================
Monitor statistics for IP filter 3 entry 10
===============================================================================
-------------------------------------------------------------------------------
At time t = 0 sec (Base Statistics)
-------------------------------------------------------------------------------
Ing. Matches : 3 pkts (384 bytes)
Egr. Matches : 0 pkts
Ing. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
Egr. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
-------------------------------------------------------------------------------
At time t = 11 sec (Mode: Rate)
-------------------------------------------------------------------------------
Ing. Matches : 1499 pkts (191907 bytes)
Egr. Matches : 0 pkts
Ing. Rate-limiter
Offered : 1500 pkts (191942 bytes)
Forwarded : 996 pkts (127465 bytes)
Dropped : 504 pkts (64477 bytes)
Egr. Rate-limiter
Offered : 0 pkts
Forwarded : 0 pkts
Dropped : 0 pkts
---snip---*A:PE-1# monitor service id 1 sap 1/1/c18/1 rate repeat 6 interval 11
===============================================================================
Monitor statistics for Service 1 SAP 1/1/c18/1
===============================================================================
-------------------------------------------------------------------------------
At time t = 0 sec (Base Statistics)
-------------------------------------------------------------------------------
---snip---
-------------------------------------------------------------------------------
At time t = 11 sec (Mode: Rate)
-------------------------------------------------------------------------------
---snip---
-------------------------------------------------------------------------------
At time t = 22 sec (Mode: Rate)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Sap Aggregate Stats
-------------------------------------------------------------------------------
Packets Octets
Ingress
Aggregate Offered : 0 0
Aggregate Forwarded : 0 0
Aggregate Dropped : 0 0
Egress
Aggregate Forwarded : 0 0
Aggregate Dropped : 0 0
-------------------------------------------------------------------------------
Sap Statistics
-------------------------------------------------------------------------------
Last Cleared Time : 04/12/2024 16:50:30
Packets Octets % Port
Util.
CPM Ingress : 0 0 0.00
Forwarding Engine Stats
Dropped : 0 0 0.00
Received Valid : 455 58182 ~0.00
Off. HiPrio : 0 0 0.00
Off. LowPrio : 0 0 0.00
Off. Uncolor : 0 0 0.00
Off. Managed : 0 0 0.00
---snip---When sending traffic at a rate of 1500 packets/s with a 128 bytes packet-size and monitoring at exit-point SAP 1/1/c20/1 over 11 s intervals, only 1000 packets/s are sent out of interface int-TST-receiver, accounting for 128000 octets/s. The output shows:
*A:PE-1# monitor service id 1 sap 1/1/c20/1 rate repeat 6 interval 11
===============================================================================
Monitor statistics for Service 1 SAP 1/1/c20/1
===============================================================================
-------------------------------------------------------------------------------
At time t = 0 sec (Base Statistics)
-------------------------------------------------------------------------------
---snip---
-------------------------------------------------------------------------------
At time t = 11 sec (Mode: Rate)
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
Sap Aggregate Stats
-------------------------------------------------------------------------------
Packets Octets
Ingress
Aggregate Offered : 0 0
Aggregate Forwarded : 0 0
Aggregate Dropped : 0 0
Egress
Aggregate Forwarded : 996 127454
Aggregate Dropped : 0 0
-------------------------------------------------------------------------------
Sap Statistics
-------------------------------------------------------------------------------
Last Cleared Time : 04/12/2024 16:56:05
Packets Octets % Port
Util.
CPM Ingress : 0 0 0.00
Forwarding Engine Stats
Dropped : 0 0 0.00
Received Valid : 0 0 0.00
Off. HiPrio : 0 0 0.00
Off. LowPrio : 0 0 0.00
Off. Uncolor : 0 0 0.00
Off. Managed : 0 0 0.00
Queueing Stats(Ingress QoS Policy 1)
Dro. HiPrio : 0 0 0.00
Dro. LowPrio : 0 0 0.00
For. InProf : 0 0 0.00
For. OutProf : 0 0 0.00
Queueing Stats(Egress QoS Policy 1)
Dro. In/InplusProf : 0 0 0.00
Dro. Out/ExcProf : 0 0 0.00
For. In/InplusProf : 996 127454 ~0.00
For. Out/ExcProf : 0 0 0.00
-------------------------------------------------------------------------------
Sap per Queue Stats
-------------------------------------------------------------------------------
Packets Octets % Port
Util.
Ingress Queue 1 (Unicast) (Priority)
Off. HiPrio : 0 0 0.00
Off. LowPrio : 0 0 0.00
Dro. HiPrio : 0 0 0.00
Dro. LowPrio : 0 0 0.00
For. InProf : 0 0 0.00
For. OutProf : 0 0 0.00
Ingress Queue 11 (Multipoint) (Priority)
Off. Combined : 0 0 0.00
Off. Managed : 0 0 0.00
Dro. HiPrio : 0 0 0.00
Dro. LowPrio : 0 0 0.00
For. InProf : 0 0 0.00
For. OutProf : 0 0 0.00
Egress Queue 1
For. In/InplusProf : 996 127454 ~0.00
For. Out/ExcProf : 0 0 0.00
Dro. In/InplusProf : 0 0 0.00
Dro. Out/ExcProf : 0 0 0.00
---snip---- clear service statistics id <service-id> counters, or clear service statistics sap <sap-id> all or clear service statistics sap <sap-id> counters, followed by: show service id <service-id> sap <sap-id> base, show service id <service-id> sap <sap-id> stats and show service id <service-id> sap <sap-id> sap-stats after the end of the counting period
- clear filter ip|ipv6|mac <filter-id>, followed by: show filter ip|ipv6|mac <filter-id> counters [detail] after the end of the counting period
Conclusion
Rate-limiting filter actions can be used by network operators for security purposes to protect network resources and can also be used to mitigate DDoS attacks.