Rate Limiting for ICMP messages
SR Linux limits the rate of ICMP messages that it generates and sends towards IPv4 and IPv6 hosts. It maintains a list of the 1000 most-recent source IP addresses that triggered the need to send an ICMP message to that endpoint. SR Linux does not allow an ICMP message to be transmitted to a source IP entry in the list if the last message sent to that host (of any type and code) was transmitted less than 1 second ago; as a result, there is a limit of 1000 ICMP error/redirect messages per second towards all sources.
To do this, SR Linux maintains a token bucket for each of the last 1000 IPv4 and 1000 IPv6 senders that generated traffic requiring ICMP messages to be sent back to them. The token bucket for each sender has a maximum depth of 10 packets, and can be filled or drained at a rate of 10 packets per second. You can adjust the maximum depth of the token bucket and the rate at which it is filled or drained.
Configuring rate limiting for ICMP messages
Each token bucket has a maximum depth, counted in terms of ICMP messages, which is controlled by the max-burst parameter (default 10 packets), and a fill/drain rate, which is controlled by the peak-rate parameter (default 10 packets per second).
To configure rate limiting for ICMP messages, you can set values for the
max-burst and peak-rate parameters. The
token bucket state for each host is refilled at the peak-rate up to
a maximum depth of max-burst.
Configure rate limiting for IPv4 ICMP messages
The following example sets values for the max-burst and peak-rate parameters for IPv4 ICMP messages.
--{ + candidate shared default }--[ ]--
# info system datapath icmp
system {
datapath {
icmp {
rate-limit-per-host {
peak-rate 20
max-burst 40
}
}
}
}Configure rate limiting for IPv6 ICMP messages
The following example sets values for the max-burst and peak-rate parameters for IPv6 ICMP messages.
--{ + candidate shared default }--[ ]--
# info system datapath icmp
system {
datapath {
icmp6 {
rate-limit-per-host {
peak-rate 20
max-burst 40
}
}
}
}