Limiting Pings

Contents

This scenario shows how to set or remove ICMP DDoS protection features for the Ping Flood attack.

ICMP Disable Limit On Echo Reply

Description

Effect of disabling an active ICMP DDoS protection for Ping Flood.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system ip icmp rate limit 0
set system ip icmp rate messages-burst 0
set system ip icmp rate messages-per-second 0
set system ip icmp rate type echo_reply
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.1/24
set protocols static route 20.0.0.0/24 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 5 size 56 timeout 1 interval 0.002

Show output

PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.

--- 10.0.0.2 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 40ms

Attention

Depending on the architecture of the device after setting messages-burst the previous burst allowance must be spent before changes take effect, by default is set to 50.

Show output

ping 10.0.0.2 count 50 size 1 timeout 1 interval 0.002

Step 4: Modify the following configuration lines in DUT0 :

set system ip icmp rate type none

Step 5: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 5 size 56 timeout 1

Show output

PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.223 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.231 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.299 ms
64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=0.216 ms
64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=0.217 ms

--- 10.0.0.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4075ms
rtt min/avg/max/mdev = 0.216/0.237/0.299/0.031 ms

---

ICMP Enable Limit On All Echo Reply

Description

Effect of enabling ICMP DDoS protection for Ping Flood.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.0.0.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.0.0.1/24
set protocols static route 20.0.0.0/24 next-hop 10.0.0.2
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 1 size 56 timeout 1

Show output

PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.302 ms

--- 10.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.302/0.302/0.302/0.000 ms

Step 4: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 5 size 56 timeout 1

Show output

PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=64 time=0.202 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=64 time=0.233 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=64 time=0.222 ms
64 bytes from 10.0.0.2: icmp_seq=4 ttl=64 time=0.243 ms
64 bytes from 10.0.0.2: icmp_seq=5 ttl=64 time=0.306 ms

--- 10.0.0.2 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4075ms
rtt min/avg/max/mdev = 0.202/0.241/0.306/0.035 ms

Step 5: Modify the following configuration lines in DUT0 :

set system ip icmp rate limit 0
set system ip icmp rate messages-burst 0
set system ip icmp rate messages-per-second 0
set system ip icmp rate type echo_reply

Step 6: Ping IP address 10.0.0.2 from DUT1:

admin@DUT1$ ping 10.0.0.2 count 5 size 56 timeout 1 interval 0.002

Show output

PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.

--- 10.0.0.2 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 40ms

Attention

Depending on the architecture of the device after setting messages-burst the previous burst allowance must be spent before changes take effect, by default is set to 50.

Show output

ping 10.0.0.2 count 50 size 1 timeout 1 interval 0.002

---