I have a VPS with debian 10 installed, primarily used for website hosting. when I issue a ping to the server from a remote machine, I am able to and receive responses for packet sizes up to around 64Kb using -s 65507 flag. using sudo also enables me to increase the default ping maximum frequency from 5 per second using the -i flag. as the man ping page states, this is plausible behaviour.

what I would like to know is on the server, how can I limit ping responses to e.g. maximum x responses per second and maximum y Kb packet size? so that the command following command should NOT be possible:

sudo ping example.com -s 65507 -i 0.001

that is, "send 1000 64Kb pings to example.com every second".

which would flood the server with 64Mb/s worth of pings, all of which are being answered (albeit with a backlog) and reported back to the ping-issuing remote machine. I repeat, I do NOT want this to be possible for obvious reasons. despite having a basic firewall and fail2ban I am astonished this is possible at all and permissible with default config settings.

I have googled to no avail - nearly all results are for issuing the ping itself, there is nothing on how to limit responses on the target server. I have also tried changing /proc/sys/net/ipv4/icmp_ratelimit to a lower value than 1000 ICMP packets per second, but this appears to have no effect, even when reboot-proofing in /etc/sysctl.conf.

ideally, I would like to set a maximum interval of 0.5 seconds and a maximum packet size of 32 bytes, which I feel is perfectly adequate and reasonable for the purpose of pinging, i.e. checking connectivity and latency. by doing this it would defend against ping flooding, which is a big concern, because as it stands at the moment the server is prone to DoS attacks through this ICMP vector.

do I need some other tool or software, or am I missing something?

many thanks in advance


Examples of rate limiting ICMP via firewall exist. nftables wiki, Rate limiting matchings. Server Fault, Rate limiting ICMP flood with nftables

However, a host firewall is not a complete solution if bandwidth is saturated. The kernel needs to get the packet before it can be dropped. More complete denial of service protection needs to be earlier, through a service with more bandwidth than the attackers.

  • would than mean a service such as cloudflare? Feb 7 '20 at 18:17
  • Any DoS filter before your host. Firewalls, specialty DoS protection services. Feb 7 '20 at 18:46

You probably need to change /proc/sys/net/ipv4/icmp_ratemask as well. By default the limit does not apply to echo replies. See http://man7.org/linux/man-pages/man7/icmp.7.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.