RTS DV-3400 Technical Information PDF herunterladen (Seite 328)

Port Traffic Controls

All-Traffic Rate-Limiting for the 5300xl, 3400cl and 6400cl Switches

ICMP Rate-Limiting

In IP networks, ICMP messages are generated in response to either inquiries

or requests from routing and diagnostic functions. These messages are

directed to the applications originating the inquiries. In unusual situations, if

the messages are generated rapidly with the intent of overloading network

circuits, they can threaten network availability. This problem is visible in

denial-of-service (DoS) attacks or other malicious behaviors where a worm

or virus overloads the network with ICMP messages to an extent where no

other traffic can get through. (ICMP messages themselves can also be misused

as virus carriers). Such malicious misuses of ICMP can include a high number

of ping packets that mimic a valid source IP address and an invalid destination

IP address (spoofed pings), and a high number of response messages (such

as Destination Unreachable error messages) generated by the network. ICMP

Rate-Limiting provides a method for limiting the amount of bandwidth that

may be utilized for inbound ICMP traffic on a switch port or trunk. This feature

allows users to restrict ICMP traffic to levels that permit necessary ICMP

functions, but throttle additional traffic that may be due to worms or viruses

(reducing their spread and effect). In addition, this preserves inbound port

bandwidth for non-ICMP traffic.

Terminology

All-Traffic Rate-Limiting: Applies a rate-limit to all inbound traffic, includ-

ing ICMP traffic, received on an interface.

ICMP Rate-Limiting: Applies a rate-limit to all inbound ICMP traffic received

on an interface, but does not limit other types of inbound traffic.

Spoofed Ping: An ICMP echo request packet intentionally generated with a

valid source IP address and an invalid destination IP address. Spoofed

pings are often created with the intent to oversubscribe network

resources with traffic having invalid destinations.

Effect of ICMP Rate-Limiting

ICMP rate-limiting generally allows only a specified percentage of an inter-

face’s inbound bandwidth to be used for ICMP traffic. As a result, inbound

bandwidth is preserved for non-ICMP traffic and the port or trunk throttles

any sudden flood of inbound ICMP traffic that may be due to a worm or virus

attack (or any other cause). Notice that ICMP rate-limiting does not throttle

non-ICMP traffic. In cases where you want to throttle both ICMP traffic and

all other inbound traffic on a given interface, you can configure both ICMP

rate-limiting and all-traffic rate-limiting.

14-10

1 2 ... 323 324 325 326 327 328 329 330 331 332 333 ... 579 580

Keine Kommentare

RTS DV-3400 Technical Information Seite 328