这几天发现在FreeBSD6.0的WEB服务器上有ICMP包限…

如下：
    “Limiting icmp unreach response from 201 to 200 packets per second”
终端总有提示，而且总是到201，估计是有个轻量级的扫描软件在发包，由于是内网，与公网完全物理断开，攻击的可能性很小，但很是烦人，查了些资料，提示：
What are these messages about ``icmp-response bandwidth limit 300/200 pps'' in my log files?
This is the kernel telling you that some activity is provoking it to send more ICMP or TCP reset (RST) responses than it thinks it should. ICMP responses are often generated as a result of attempted connections to unused UDP ports. TCP resets are generated as a result of attempted connections to unopened TCP ports. Among others, these are the kinds of activities which may cause these messages:
Brute-force denial of service (DoS) attacks (as opposed to single-packet attacks which exploit a specific vulnerability).
Port scans which attempt to connect to a large number of ports (as opposed to only trying a few well-known ports).
The first number in the message tells you how many packets the kernel would have sent if the limit was not in place, and the second number tells you the limit. You can control the limit using the net.inet.icmp.icmplim sysctl variable like this, where 300 is the limit in packets per second:
    # sysctl -w net.inet.icmp.icmplim=300
If you do not want to see messages about this in your log files, but you still want the kernel to do response limiting, you can use the net.inet.icmp.icmplim_output sysctl variable to disable the output like this:
    # sysctl -w net.inet.icmp.icmplim_output=0
Finally, if you want to disable response limiting, you can set the net.inet.icmp.icmplim sysctl variable (see above for an example) to 0. Disabling response limiting is discouraged for the reasons listed above.

最好我在/etc/sysctl.conf  中加入了“net.inet.icmp.icmplim_output=0”去掉这些提示，静待结果如何。


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/12437/showart_85397.html

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有