HP ProCurve 6600 all), icmp, rate-limit, rate-limit, ICMP, All traffic, Terminology

C a u t i o n

N o t e

Port Traffic Controls

Rate-Limiting

messages to an extent where no other traffic can get through. (ICMP messages themselves can also be misused as virus carriers). Such malicious misuses of ICMP can include a high number of ping packets that mimic a valid source IP address and an invalid destination IP address (spoofed pings), and a high number of response messages (such as Destination Unreachable error mes­ sages) generated by the network.

ICMP rate-limiting provides a method for limiting the amount of bandwidth that may be utilized for inbound ICMP traffic on a switch port or trunk. This feature allows users to restrict ICMP traffic to percentage levels that permit necessary ICMP functions, but throttle additional traffic that may be due to worms or viruses (reducing their spread and effect). In addition, ICMP rate-limiting preserves inbound port bandwidth for non-ICMP traffic.

The ICMP protocol is necessary for routing, diagnostic, and error responses in an IP network. ICMP rate-limiting is primarily used for throttling worm or virus-like behavior, and should normally be configured to allow one to five per cent of available inbound bandwidth (at 10 Mbps or 100 Mbps speeds) or 100

-10,000 kbps (1Gbps or 10 Gbps speeds) to be used for ICMP traffic. This feature should not be used to remove all ICMP traffic from a network.

ICMP rate-limiting does not throttle non-ICMP traffic. In cases where you want to throttle both ICMP traffic and all other inbound traffic on a given interface, you can separately configure both ICMP rate-limiting and all-traffic rate- limiting.

Beginning with software release K.12.xx or later, the all-traffic rate-limiting command (rate-limit all) and the ICMP rate-limiting command (rate-limit icmp) operate differently:

•All traffic rate-limiting applies to both inbound and outbound traffic, and can be specified either in terms of a percentage of total bandwidth or in terms of bits per second;

•ICMP rate-limiting applies only to inbound traffic, and can only be specified as a percentage of total bandwidth.

Terminology

All-TrafficRate-Limiting:Applies a rate-limit to all traffic (including ICMP traffic) on an interface. For details, see “Rate-Limiting” on page 13-4.

ICMP Rate-Limiting:Applies a rate-limit to all inbound ICMP traffic received on an interface, but does not limit other types of inbound traffic.

13-11