Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Chapter Title

ICMP Unreachable Rate Limiting User Feedback

Results

Updated:
September 3, 2014

Chapter: ICMP Unreachable Rate Limiting User Feedback

Contents

ICMP Unreachable Rate Limiting User Feedback

This chapter describes ICMP Unreachable Rate Limiting User Feedback and procedures to configure ICMP Unreachable Rate Limiting User Feedback.

Configuring ICMP Unreachable Rate Limiting User Feedback

Perform this task to clear all of the unreachable destination packet statistics and to specify an interval number for unreachable destination messages. This task also configures a packet counter (threshold) and interval to trigger a logging message to a console. This task is beneficial to begin a new log after the thresholds have been set.

Configuring ICMP Unreachable Rate Limiting User Feedback

SUMMARY STEPS

    1.    enable

    2.    clear ip icmp rate-limit[interface-type interface-number]

    3.    configure terminal

    4.    ip icmp rate-limit unreachable [df][ms] [log [packets] [interval-ms]]

    5.    exit

    6.    show ip icmp rate-limit[interface-type interface-number]


DETAILED STEPS
     Command or ActionPurpose
    Step 1enable


    Example:
    Switch> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.
     
    Step 2clear ip icmp rate-limit[interface-type interface-number]

    Example:
    Switch# clear ip icmp rate-limit GigabitEthernet 0/3
     

    Clears all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments clear the statistics for only one interface.

     
    Step 3configure terminal


    Example:
    Switch# configure terminal
     

    Enters global configuration mode

     
    Step 4ip icmp rate-limit unreachable [df][ms] [log [packets] [interval-ms]]

    Example:
    Switch(config)# ip icmp rate-limit unreachable df log 1100 12000
     

    Specifies the rate limitation of ICMP unreachable destination messages and the error message log threshold for generating a message. The default is no unreachable messages are sent more often than once every half second.

    The arguments and keywords are as follows:

    • df --(Optional) When "don't fragment" (DF) bit is set in the ICMP header, a datagram cannot be fragmented. If the df keyword is not specified, all other types of destination unreachable messages are sent.
    • ms --(Optional) Interval at which unreachable messages are generated. The valid range is from 1 to 4294967295.
    • log --(Optional) List of error messages. The arguments are as follows:
      • packets--(Optional) Number of packets that determine a threshold for generating a log. The default is 1000.
      • interval-ms--(Optional) Time limit for an interval for which a logging message is triggered. The default is 60000, which is 1 minute.
    Note   

    Counting begins as soon as this command is configured.

     
    Step 5exit


    Example:
    Switch(config)# exit
     

    Exits to privileged EXEC mode.

     
    Step 6show ip icmp rate-limit[interface-type interface-number]

    Example:
    Switch# show ip icmp rate-limit ethernet 2/3
     

    (Optional) Displays all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments display the statistics for only one interface.

     

    Examples:

    The following output using the show ip icmp rate-limit command displays the unreachable destinations by interface:
    Switch# show ip icmp rate-limit
                               DF bit unreachables       All other unreachables
Interval (millisecond)     500                       500
Interface                  # DF bit unreachables     # All other unreachables 
---------                  ---------------------     ------------------------ 
Ethernet0/0                0                         0                        
Ethernet0/2                0                         0                        
Serial3/0/3                0                         19 
The greatest number of unreachables is on serial interface 3/0/3

    ICMP Unreachable Destination Counters

    The ICMP Unreachable Destination Counters feature enables you to clear and display packets that have been discarded because of an unreachable destination, and to configure a threshold interval for triggering error messages. When message logging is generated, it displays on your console.

    Finding Support Information for Platforms and Cisco IOS Software Images

    Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http:/​/​www.cisco.com/​go/​fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

    ICMP Overview

    Originally created for the TCP/IP suite in RFC 792, the Internet Control Message Protocol (ICMP) was designed to report a small set of error conditions. ICMP also can report a wide variety of error conditions, provide feedback and testing capabilities. It is a valuable support tool because each message uses a common format and is sent and received by using the same protocol rules.

    ICMP enables IP to perform addressing, datagram packaging, and routing by allowing encapsulated messages to be sent and received between IP devices. These messages are encapsulated in IP datagrams just like any other IP message. When the message is generated, the original IP header is encapsulated in the ICMP message and these two pieces are encapsulated within a new IP header to be returned as an error report to the sending device.

    ICMP messages are sent in several situations: for example, when a datagram cannot reach its destination, when the gateway does not have the buffering capacity to forward a datagram, and when the gateway can direct the host to send traffic on a shorter route. To avoid the infinite regress of messages about messages, no ICMP messages are sent about ICMP messages.

    ICMP does not make IP reliable or ensure the delivery of datagrams or the return of a control message. Some datagrams may be dropped without any report of their loss. The higher-level protocols that use IP must implement their own reliability procedures if reliable communication is required.

    For information about IPv6 and ICMP, see the Cisco IOS IPv6 Configuration Guide, Release 12.4 and Cisco IOS IPv6 Command Reference, Release 12.4.

    Denial of Service Attack

    A DoS attack occurs when a stream of ICMP echo requests (pings) are broadcast to a destination subnet. The source addresses of these requests are falsified to be the source address of the target. For each request sent by the attacker, many hosts on the subnet will respond flooding the target and wasting bandwidth. The most common DoS attack is called a “smurf” attack, named after an executable program and is in the category of network-level attacks against hosts. DoS attacks can be easily detected when error-message logging of the ICMP Unreachable Destination Counters feature is enabled.

    Clearing the ICMP Unreachable Destination Packet Statistics

    Perform this task to clear all of the unreachable destination packet statistics. This task is beneficial to begin a new log after the thresholds have been set.

    SUMMARY STEPS

      1.    enable

      2.    clear ip icmp rate-limit [interface-type interface-number]

      3.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example: 
      Switch> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.
       
      Step 2 clear ip icmp rate-limit [interface-type interface-number]


      Example: 
      Switch# clear ip icmp rate-limit GigabitEthernet 0/3
       

      Clears all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments clear the statistics for only one interface.

      Note   

      See the interface command in the Cisco IOS Interface and Hardware Component Command Reference, Release 12.4 for valid interface types.

       
      Step 3 end


      Example: 
      Switch# end
       

      Exits to user EXEC mode.

       

      Configuring ICMP Unreachable Destination Counters and Logging Intervals

      Perform this task to specify an interval number for unreachable destination messages and a packet counter (threshold) and interval to trigger a logging message to a console. Counting begins as soon as the ip icmp rate-limit unreachable command is configured.

      Before You Begin

      Clearing the ICMP Unreachable Destination Packet Statistics

      When Cisco ME 2600X is configured with a default static route such as IP route 0.0.0.0 0.0.0.0 g1/1 then for any destination IP destination unreachable counters do not increase.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]

        4.    exit


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example: 
        Switch> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.
         
        Step 2 configure terminal


        Example: 
        Switch# configure terminal
         

        Enters global configuration mode.

         
        Step 3 ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]


        Example: 
        Switch(config)# ip icmp rate-limit unreachable df log 1100 12000
         

        Specifies the rate limitation of ICMP unreachable destination messages and the error message log threshold for generating a message. The default is no unreachable messages are sent more often than once every half second.

        The arguments and keywords are as follows:

        • df—(Optional) When Don’t Fragment (DF) bit is set in the ICMP header, a datagram cannot be fragmented. If the df keyword is not specified, all other types of destination unreachable messages are sent.
        • ms—(Optional) Interval at which unreachable messages are generated. The valid range is from 1 ms to 4294967295 ms.
        • log—(Optional) List of error messages. The arguments are as follows:
          • packets—(Optional) Number of packets that determine a threshold for generating a log. The default is 1000 packets.
          • interval-ms—(Optional) Time limit for an interval for which a logging message is triggered. The default is 60000 ms, which is 1 minute.
        Note   

        Counting begins as soon as this command is configured.

         
        Step 4 exit


        Example: 
        Switch(config)# exit
         

        Exits to privileged EXEC mode.

         

        Displaying the ICMP Unreachable Destination Packets

        Perform this optional task to display all of the unreachable destination packet statistics, which include dropped packets. Counting begins as soon as the ip icmp rate-limit unreachable command is configured.

        SUMMARY STEPS

          1.    enable

          2.    show ip icmp rate-limit [interface-type interface-number]

          3.    end


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example: 
          Switch> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.
           
          Step 2show ip icmp rate-limit [interface-type interface-number]

          Example: 
          Switch# show ip icmp rate-limit GigabitEthernet 0/3
           

          Displays all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments displays the statistics for only one interface.

          Note   

          See the interface command in the Cisco IOS Interface and Hardware Component Command Reference, Release 12.4 for valid interface types

           
          Step 3end


          Example: 
          Switch# end
           

           

          Example

          The following output using the show ip icmp rate-limit command displays the unreachable destinations by interface:

          Switch# show ip icmp rate-limit
                   DF bit unreachables       All other unreachables
Interval (millisecond)     500                       500

Interface                  # DF bit unreachables     # All other unreachables 
---------                  ---------------------     ------------------------ 
Ethernet0/0                0                         0                        
Ethernet0/2                0                         0                        
 The greatest number of unreachables is on serial interface 3/0/3.
          ICMP Unreachable Rate Limiting User Feedback

          ICMP Unreachable Rate Limiting User Feedback

          This chapter describes ICMP Unreachable Rate Limiting User Feedback and procedures to configure ICMP Unreachable Rate Limiting User Feedback.

          Configuring ICMP Unreachable Rate Limiting User Feedback

          Perform this task to clear all of the unreachable destination packet statistics and to specify an interval number for unreachable destination messages. This task also configures a packet counter (threshold) and interval to trigger a logging message to a console. This task is beneficial to begin a new log after the thresholds have been set.

          Configuring ICMP Unreachable Rate Limiting User Feedback

          SUMMARY STEPS

            1.    enable

            2.    clear ip icmp rate-limit[interface-type interface-number]

            3.    configure terminal

            4.    ip icmp rate-limit unreachable [df][ms] [log [packets] [interval-ms]]

            5.    exit

            6.    show ip icmp rate-limit[interface-type interface-number]


          DETAILED STEPS
             Command or ActionPurpose
            Step 1enable


            Example:
            Switch> enable
             

            Enables privileged EXEC mode.

            • Enter your password if prompted.
             
            Step 2clear ip icmp rate-limit[interface-type interface-number]

            Example:
            Switch# clear ip icmp rate-limit GigabitEthernet 0/3
             

            Clears all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments clear the statistics for only one interface.

             
            Step 3configure terminal


            Example:
            Switch# configure terminal
             

            Enters global configuration mode

             
            Step 4ip icmp rate-limit unreachable [df][ms] [log [packets] [interval-ms]]

            Example:
            Switch(config)# ip icmp rate-limit unreachable df log 1100 12000
             

            Specifies the rate limitation of ICMP unreachable destination messages and the error message log threshold for generating a message. The default is no unreachable messages are sent more often than once every half second.

            The arguments and keywords are as follows:

            • df --(Optional) When "don't fragment" (DF) bit is set in the ICMP header, a datagram cannot be fragmented. If the df keyword is not specified, all other types of destination unreachable messages are sent.
            • ms --(Optional) Interval at which unreachable messages are generated. The valid range is from 1 to 4294967295.
            • log --(Optional) List of error messages. The arguments are as follows:
              • packets--(Optional) Number of packets that determine a threshold for generating a log. The default is 1000.
              • interval-ms--(Optional) Time limit for an interval for which a logging message is triggered. The default is 60000, which is 1 minute.
            Note   

            Counting begins as soon as this command is configured.

             
            Step 5exit


            Example:
            Switch(config)# exit
             

            Exits to privileged EXEC mode.

             
            Step 6show ip icmp rate-limit[interface-type interface-number]

            Example:
            Switch# show ip icmp rate-limit ethernet 2/3
             

            (Optional) Displays all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments display the statistics for only one interface.

             

            Examples:

            The following output using the show ip icmp rate-limit command displays the unreachable destinations by interface:
            Switch# show ip icmp rate-limit
                                       DF bit unreachables       All other unreachables
Interval (millisecond)     500                       500
Interface                  # DF bit unreachables     # All other unreachables 
---------                  ---------------------     ------------------------ 
Ethernet0/0                0                         0                        
Ethernet0/2                0                         0                        
Serial3/0/3                0                         19 
The greatest number of unreachables is on serial interface 3/0/3

            ICMP Unreachable Destination Counters

            The ICMP Unreachable Destination Counters feature enables you to clear and display packets that have been discarded because of an unreachable destination, and to configure a threshold interval for triggering error messages. When message logging is generated, it displays on your console.

            Finding Support Information for Platforms and Cisco IOS Software Images

            Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http:/​/​www.cisco.com/​go/​fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

            ICMP Overview

            Originally created for the TCP/IP suite in RFC 792, the Internet Control Message Protocol (ICMP) was designed to report a small set of error conditions. ICMP also can report a wide variety of error conditions, provide feedback and testing capabilities. It is a valuable support tool because each message uses a common format and is sent and received by using the same protocol rules.

            ICMP enables IP to perform addressing, datagram packaging, and routing by allowing encapsulated messages to be sent and received between IP devices. These messages are encapsulated in IP datagrams just like any other IP message. When the message is generated, the original IP header is encapsulated in the ICMP message and these two pieces are encapsulated within a new IP header to be returned as an error report to the sending device.

            ICMP messages are sent in several situations: for example, when a datagram cannot reach its destination, when the gateway does not have the buffering capacity to forward a datagram, and when the gateway can direct the host to send traffic on a shorter route. To avoid the infinite regress of messages about messages, no ICMP messages are sent about ICMP messages.

            ICMP does not make IP reliable or ensure the delivery of datagrams or the return of a control message. Some datagrams may be dropped without any report of their loss. The higher-level protocols that use IP must implement their own reliability procedures if reliable communication is required.

            For information about IPv6 and ICMP, see the Cisco IOS IPv6 Configuration Guide, Release 12.4 and Cisco IOS IPv6 Command Reference, Release 12.4.

            Denial of Service Attack

            A DoS attack occurs when a stream of ICMP echo requests (pings) are broadcast to a destination subnet. The source addresses of these requests are falsified to be the source address of the target. For each request sent by the attacker, many hosts on the subnet will respond flooding the target and wasting bandwidth. The most common DoS attack is called a “smurf” attack, named after an executable program and is in the category of network-level attacks against hosts. DoS attacks can be easily detected when error-message logging of the ICMP Unreachable Destination Counters feature is enabled.

            Clearing the ICMP Unreachable Destination Packet Statistics

            Perform this task to clear all of the unreachable destination packet statistics. This task is beneficial to begin a new log after the thresholds have been set.

            SUMMARY STEPS

              1.    enable

              2.    clear ip icmp rate-limit [interface-type interface-number]

              3.    end


            DETAILED STEPS
               Command or ActionPurpose
              Step 1 enable


              Example: 
              Switch> enable
               

              Enables privileged EXEC mode.

              • Enter your password if prompted.
               
              Step 2 clear ip icmp rate-limit [interface-type interface-number]


              Example: 
              Switch# clear ip icmp rate-limit GigabitEthernet 0/3
               

              Clears all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments clear the statistics for only one interface.

              Note   

              See the interface command in the Cisco IOS Interface and Hardware Component Command Reference, Release 12.4 for valid interface types.

               
              Step 3 end


              Example: 
              Switch# end
               

              Exits to user EXEC mode.

               

              Configuring ICMP Unreachable Destination Counters and Logging Intervals

              Perform this task to specify an interval number for unreachable destination messages and a packet counter (threshold) and interval to trigger a logging message to a console. Counting begins as soon as the ip icmp rate-limit unreachable command is configured.

              Before You Begin

              Clearing the ICMP Unreachable Destination Packet Statistics

              When Cisco ME 2600X is configured with a default static route such as IP route 0.0.0.0 0.0.0.0 g1/1 then for any destination IP destination unreachable counters do not increase.

              SUMMARY STEPS

                1.    enable

                2.    configure terminal

                3.    ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]

                4.    exit


              DETAILED STEPS
                 Command or ActionPurpose
                Step 1 enable


                Example: 
                Switch> enable
                 

                Enables privileged EXEC mode.

                • Enter your password if prompted.
                 
                Step 2 configure terminal


                Example: 
                Switch# configure terminal
                 

                Enters global configuration mode.

                 
                Step 3 ip icmp rate-limit unreachable [df] [ms] [log [packets] [interval-ms]]


                Example: 
                Switch(config)# ip icmp rate-limit unreachable df log 1100 12000
                 

                Specifies the rate limitation of ICMP unreachable destination messages and the error message log threshold for generating a message. The default is no unreachable messages are sent more often than once every half second.

                The arguments and keywords are as follows:

                • df—(Optional) When Don’t Fragment (DF) bit is set in the ICMP header, a datagram cannot be fragmented. If the df keyword is not specified, all other types of destination unreachable messages are sent.
                • ms—(Optional) Interval at which unreachable messages are generated. The valid range is from 1 ms to 4294967295 ms.
                • log—(Optional) List of error messages. The arguments are as follows:
                  • packets—(Optional) Number of packets that determine a threshold for generating a log. The default is 1000 packets.
                  • interval-ms—(Optional) Time limit for an interval for which a logging message is triggered. The default is 60000 ms, which is 1 minute.
                Note   

                Counting begins as soon as this command is configured.

                 
                Step 4 exit


                Example: 
                Switch(config)# exit
                 

                Exits to privileged EXEC mode.

                 

                Displaying the ICMP Unreachable Destination Packets

                Perform this optional task to display all of the unreachable destination packet statistics, which include dropped packets. Counting begins as soon as the ip icmp rate-limit unreachable command is configured.

                SUMMARY STEPS

                  1.    enable

                  2.    show ip icmp rate-limit [interface-type interface-number]

                  3.    end


                DETAILED STEPS
                   Command or ActionPurpose
                  Step 1 enable


                  Example: 
                  Switch> enable
                   

                  Enables privileged EXEC mode.

                  • Enter your password if prompted.
                   
                  Step 2show ip icmp rate-limit [interface-type interface-number]

                  Example: 
                  Switch# show ip icmp rate-limit GigabitEthernet 0/3
                   

                  Displays all current ICMP unreachable statistics for all configured interfaces. The optional interface-type and interface-number arguments displays the statistics for only one interface.

                  Note   

                  See the interface command in the Cisco IOS Interface and Hardware Component Command Reference, Release 12.4 for valid interface types

                   
                  Step 3end


                  Example: 
                  Switch# end
                   

                   

                  Example

                  The following output using the show ip icmp rate-limit command displays the unreachable destinations by interface:

                  Switch# show ip icmp rate-limit
                           DF bit unreachables       All other unreachables
Interval (millisecond)     500                       500

Interface                  # DF bit unreachables     # All other unreachables 
---------                  ---------------------     ------------------------ 
Ethernet0/0                0                         0                        
Ethernet0/2                0                         0                        
 The greatest number of unreachables is on serial interface 3/0/3.

                  Was this Document Helpful?

                  FeedbackFeedback

                  Contact Cisco

                  Related Cisco Community Discussions

                  About Us
                  Contact Us
                  Work with Us