Configuring Traffic Suppression for ICMP Packets
Context
Attackers may send a large number of ICMP packets to attack a network. Processing all these ICMP packets will occupy many CPU resources and cause service abnormalities. To resolve this problem, configure ICMP packet suppression.
After ICMP packet suppression is configured on an interface, the system automatically discards ICMP packets when the number of ICMP packets sent by an interface to the CPU every second exceeds the rate threshold.
Pre-configuration Tasks
Before configuring traffic suppression for ICMP packets, configure link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up.
Procedure
- Run system-view
The system view is displayed.
- Run undo icmp rate-limit disable
Traffic suppression for ICMP packets is enabled.
By default, the traffic suppression function for ICMP packets is enabled.
- Run icmp rate-limit [ interface interface-type interface-number1 [ to interface-number2 ] ] threshold threshold-value
The rate threshold for ICMP packets is configured.
By default, no ICMP packet rate limit is configured on an interface, and the global ICMP packet rate limit (1500 pps) is used as the ICMP packet rate limit on the interface.
- Run commit
The configuration is committed.