This article describes the default ICMP rate limit on the system for Host Inbound traffic. This is essentially the default protection mechanism of the device to help prevent denial of service (DoS) attacks.

What is the default ICMP rate for Host Inbound connections?

<packet-rate> The Junos OS platforms have a default protection mechanism to help prevent denial of service (DoS) attacks for ICMP Host Inbound connections. The default ICMP rate limit on the system can be checked using the start shell command.

NOTE : Do not run shell commands in production without JTAC supervision. Such commands may potentially impact traffic.

The following command is executed on an SRX240:

root@240> start shell
% sysctl -a | grep "inet.icmp"
net.inet.icmp.maskrepl: 0
net.inet.icmp.bucketsize: 5
net.inet.icmp.tokenrate: 1000
net.inet.icmp.drop_redirect: 0
net.inet.icmp.log_redirect: 0
net.inet.icmp.bmcastecho: 1
% exit

Notice in the output above that the ICMP rate is set to 1000; this is the default system value. If desired, the default value can be changed by using the set system command :

root@240# set system internet-options icmpv4-rate-limit packet-rate ?
Possible completions:
<packet-rate> ICMP rate-limiting packets earned per second

root@240# set system internet-options icmpv4-rate-limit packet-rate 10000


After this change, the rate limit value can be seen as follows :

root@240% sysctl -a | grep "inet.icmp"
net.inet.icmp.maskrepl: 0
net.inet.icmp.bucketsize: 5
net.inet.icmp.tokenrate: 10000
net.inet.icmp.drop_redirect: 0
net.inet.icmp.log_redirect: 0
net.inet.icmp.bmcastecho: 1


Hence we have observed the default rate limit value, which is a default DoS setting, and how it can be changed as per the requirements.