mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 04:21:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}

Browse Source 
These sysctls were added in 4cdf507d54 ("icmp: add a global rate
limitation") and their default values might be too small.

Some network tools send probes to closed UDP ports from many hosts
to estimate proportion of packet drops on a particular target.

This patch sets both sysctls to 10000.

Note the per-peer rate-limit (as described in RFC 4443 2.4 (f))
intent is still enforced.

This also increases security, see b38e7819ca
("icmp: randomize the global rate limiter") for reference.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260223161742.929830-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet
2026-02-23 16:17:42 +00:00
committed by Jakub Kicinski
parent 539a6cf084
commit 64db5933c7
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Documentation/networking/ip-sysctl.rst
View File

@@ -1758,14 +1758,14 @@ icmp_msgs_per_sec - INTEGER
controlled by this limit. For security reasons, the precise count
of messages per second is randomized.
Default: 1000
Default: 10000
icmp_msgs_burst - INTEGER
icmp_msgs_per_sec controls number of ICMP packets sent per second,
while icmp_msgs_burst controls the burst size of these packets.
while icmp_msgs_burst controls the token bucket size.
For security reasons, the precise burst size is randomized.
Default: 50
Default: 10000
icmp_ratemask - INTEGER
Mask made of ICMP types for which rates are being limited.

4
net/ipv4/icmp.c
View File

@@ -1727,8 +1727,8 @@ static int __net_init icmp_sk_init(struct net *net)
net->ipv4.sysctl_icmp_ratemask = 0x1818;
net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
net->ipv4.sysctl_icmp_errors_extension_mask = 0;
net->ipv4.sysctl_icmp_msgs_per_sec = 1000;
net->ipv4.sysctl_icmp_msgs_burst = 50;
net->ipv4.sysctl_icmp_msgs_per_sec = 10000;
net->ipv4.sysctl_icmp_msgs_burst = 10000;
return 0;
}