Re: Documentation confusion on ICMP Rate Mask/Rate Limiting

Re: Documentation confusion on ICMP Rate Mask/Rate Limiting

[FMDF]

[-- Attachment #1.1: Type: text/plain, Size: 2003 bytes --]

On Fri, 31 Dec 2021, 20:55 Daryll Swer, <daryllswer15@gmail.com> wrote:

> Hi Folks
>
> So I will get straight to the point, I am trying to figure out some
> answers on *icmp_ratelimit* and *icmp_ratemask* based on the man page
> <https://mailtrack.io/trace/link/1ab83c495d25602c6b2de3095e1a1fa4b795d988?url=https%3A%2F%2Fman7.org%2Flinux%2Fman-pages%2Fman7%2Ficmp.7.html&userId=2153471&signature=34cf95fe977ddeef>
> .
>
> The questions are:
>
>    1. How can we determine the Packet per second rate on any given
>    rate-limit value (say 10)?
>
> The values of icmp_ratelimit are expressed in milliseconds. The default is
1000 milliseconds.

Therefore, as in your questions, a limit of 10 milliseconds means that the
rate limit is 1 message per 10 millisecond, that is 100 messages per second.

Where is the problem?

Please don't ask people here to do the trivial homework for you. :(

Maybe that this the reason why nobody has yet answered your 10 days old
questions...


>    1. Without of course going the hard way of benchmarking it by ICMP
>    flooding.
>
> This is not needed and, honestly, I cannot understand why you need to test
it...

Please read the manual and my words one more time.

>
>    1. Just what exactly is the *correct mask* in *Binary form* to *include
>    all* known ICMP types instead of just the default mask? Been having a
>    hard time with this one.
>
> It's simple to build it. Read again the section about icmp_ratemask.

In the above-mentioned section there is a list with all types of ICMP
messages. The construction of a mask is also explained with a very
comprehensible example.

>
>    1. Do we have something of this nature for *IPv6 *in the Kernel? I
>    don't see it in most Linux based NetworkOSes as a documented feature.
>
> Check it by yourself. Do you have a /proc/sys/net/ipv4 directory? Well,
you should also have a /proc/sys/net/ipv6 unless you've disabled IPv6.

Look at the ./ipv6 directory and then under ./icmp.

Regards,

Fabio M. De Francesco

[-- Attachment #1.2: Type: text/html, Size: 3765 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Re: Documentation confusion on ICMP Rate Mask/Rate Limiting

[Daryll Swer]

[-- Attachment #1.1: Type: text/plain, Size: 2816 bytes --]

> In the above-mentioned section there is a list with all types of ICMP
messages. The construction of a mask is also explained with a very
comprehensible example.

The order of the bits/spacing between the bits are not continuous and hence
the confusion. I did provide the suspected correct mask in binary form,
which seems to have been missed:
"My best guess is that is is the answer to question *2*:
*1111111100100111001"*

> Look at the ./ipv6 directory and then under ./icmp.
The value is here doesn't correlate with the man page.
root@host:/proc/sys/net/ipv6/icmp# cat ratemask
0-1,3-127

*--*
Best Regards
Daryll Swer
Website: daryllswer.com
<https://mailtrack.io/trace/link/7a507c081daea9db4f442e8fdb6fdd1f8f72aee6?url=https%3A%2F%2Fwww.daryllswer.com&userId=2153471&signature=7f328f9caeb95b4c>


On Sun, 9 Jan 2022 at 14:28, FMDF <fmdefrancesco@gmail.com> wrote:

> On Fri, 31 Dec 2021, 20:55 Daryll Swer, <daryllswer15@gmail.com> wrote:
>
>> Hi Folks
>>
>> So I will get straight to the point, I am trying to figure out some
>> answers on *icmp_ratelimit* and *icmp_ratemask* based on the man page
>> <https://man7.org/linux/man-pages/man7/icmp.7.html>.
>>
>> The questions are:
>>
>>    1. How can we determine the Packet per second rate on any given
>>    rate-limit value (say 10)?
>>
>> The values of icmp_ratelimit are expressed in milliseconds. The default
> is 1000 milliseconds.
>
> Therefore, as in your questions, a limit of 10 milliseconds means that the
> rate limit is 1 message per 10 millisecond, that is 100 messages per second.
>
> Where is the problem?
>
> Please don't ask people here to do the trivial homework for you. :(
>
> Maybe that this the reason why nobody has yet answered your 10 days old
> questions...
>
>
>>    1. Without of course going the hard way of benchmarking it by ICMP
>>    flooding.
>>
>> This is not needed and, honestly, I cannot understand why you need to
> test it...
>
> Please read the manual and my words one more time.
>
>>
>>    1. Just what exactly is the *correct mask* in *Binary form* to *include
>>    all* known ICMP types instead of just the default mask? Been having a
>>    hard time with this one.
>>
>> It's simple to build it. Read again the section about icmp_ratemask.
>
> In the above-mentioned section there is a list with all types of ICMP
> messages. The construction of a mask is also explained with a very
> comprehensible example.
>
>>
>>    1. Do we have something of this nature for *IPv6 *in the Kernel? I
>>    don't see it in most Linux based NetworkOSes as a documented feature.
>>
>> Check it by yourself. Do you have a /proc/sys/net/ipv4 directory? Well,
> you should also have a /proc/sys/net/ipv6 unless you've disabled IPv6.
>
> Look at the ./ipv6 directory and then under ./icmp.
>
> Regards,
>
> Fabio M. De Francesco
>

[-- Attachment #1.2: Type: text/html, Size: 5610 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies