Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 470

Understanding How DoS Protection Works Chapter 33 Configuring Denial of Service Protection TTL Failure This rate limiter rate limits packets sent to the PISA because of a time-to-live (TTL) check failure. As indicated by the all keyword in the following example, this rate limiter applies to both multicast and unicast traffic. Note The TTL failure rate limiter is not supported for IPv6 multicast. This example shows how to rate limit the TTL failures to 70000 pps with a burst of 150: Router(config)# mls rate-limit all ttl-failure 70000 150 ICMP Unreachable (Unicast Only) In an ICMP unreachable attack, a device is flooded with a large number of packets that contain a destination address that is unreachable from the flooded device (in this case, the PISA). The ICMP unreachable rate limiter allows you to rate limit the packets that are sent to the PISA containing unreachable addresses. This example shows how to rate limit the packets that are sent to the PISA because of an ACL drop to 10000 pps and a burst of 100: Router(config)# mls rate-limit unicast ip icmp unreachable acl-drop 10000 100 This example shows how to rate limit the packets that require generation of ICMP-unreachable messages because of a FIB miss to 80000 pps and burst to 70: Router(config)# mls rate-limit unicast ip icmp unreachable no-route 80000 70 The four rate limiters, ICMP unreachable no route, ICMP unreachable ACL drop, IP errors, and IP RPF failure, share a single rate-limiter register. If any of these limiters are enabled, all of the limiters in this group will share the same value and sometimes the same state (for example, ON/ON/ON). When verifying the rate limiters, if the members of this register are enabled through another feature, an ON-Sharing status (instead of an ON status) is displayed. The exception is the TTL failure rate limiter: its value shares the same value as the other members in the register if you have manually enabled the feature. FIB (CEF) Receive Cases (Unicast Only) The FIB receive rate limiter provides the capability to rate limit all packets that contain the PISA IP address as the destination address. The rate limiters do not discriminate between good frames and bad frames. Note Do not enable the FIB receive rate limiter if you are using CoPP. The FIB receive rate limiter overrides the CoPP policies. This example shows how to rate limit the traffic to 25000 pps with a burst of 60: Router(config)# mls rate-limit unicast cef receive 25000 60 FIB Glean (Unicast Only) The FIB glean rate limiter does not limit ARP traffic, but provides the capability to rate limit traffic that requires address resolution (ARP) and requires that it be sent to the PISA. This situation occurs when traffic enters a port and contains the destination of a host on a subnet that is locally connected to the 33-8 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY OL-11439-03