feature of `packet per second`

[Freddie Cash]

On Wed, Apr 30, 2014 at 8:31 AM, bycn82 <bycn82 at gmail.com> wrote:

> On 4/30/14 23:01, Julian Elischer wrote:
>
>> On 4/30/14, 8:52 PM, bycn82 wrote:
>>
>>> Hi
>>>
>>> `packet per second` it is easy to be implemented using iptables, there
>>> is a module named `recent`, but in using ipfw, Do we have any solution to
>>> fulfill it? check the link below
>>> https://forums.freebsd.org/viewtopic.php?f=44&t=42933&p=258441#p258441
>>>
>>
>> since I don't use linux.. what is "packet per second"?.. does it report
>> it or set a limit on it?
>>
>>>
>>>  bycn82
>>>
>>> _______________________________________________
>>> freebsd-ipfw at freebsd.org mailing list
>>> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
>>> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe at freebsd.org"
>>>
>>>
>>>
>>
>>  Yes, "Packets Per Second"means limit a connection based on the packets
> number, for example, If I allow 2 ICMP packets come to my server in each
> individual second.  only the first 2 packets will be allow, all others in
> the same second will be dropped.
>

​For ICMP, specifically, there's a sysctl to control the rate (per second):

# sysctl -d ​net.inet.icmp.icmplim
net.inet.icmp.icmplim: Maximum number of ICMP responses per second


For everything else, you'd want to use dummynet(4).

-- 
Freddie Cash
fjwcash at gmail.com