Malicious users may flood a network with ICMP packets to initiate an attack. Processing large numbers of ICMP packets will consume many CPU resources and cause service abnormalities. To resolve this problem, configure ICMP packet suppression.
After ICMP packet suppression is configured on an interface, the system automatically discards ICMP packets when the number of ICMP packets sent by an interface to the CPU every second exceeds the rate threshold.
Before configuring ICMP packet suppression on an interface, run the undo icmp-reply fast command to disable the ICMP reply fast function.
Before configuring traffic suppression for ICMP packets, configure link layer protocol parameters for interfaces to ensure that the link layer protocol status on the interfaces is Up.
The system view is displayed.
Traffic suppression for ICMP packets is enabled.
By default, the traffic suppression function for ICMP packets is disabled.
The rate threshold for ICMP packets in the interface and system views is configured.
By default, the rate limits of ICMP packets in the system and on an interface depend on the product model. The value is 128 on the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S, and 190 on the other models, in pps.