ipv6 nd miss anti-attack rate-limit

Function

The ipv6 nd miss anti-attack rate-limit command configures the rate at which neighbor discovery (ND) Miss messages are sent, that is, the number of ND Miss messages allowed to be processed per second.

The undo ipv6 nd miss anti-attack rate-limit command restores the default configuration.

By default, 550 ND Miss messages are sent per second.

Format

ipv6 nd miss anti-attack rate-limit limit-number

undo ipv6 nd miss anti-attack rate-limit limit-number

undo ipv6 nd miss anti-attack rate-limit

Parameters

Parameter Description Value
limit-number

Specifies the rate at which ND Miss messages are sent.

The value is an integer in the range of 1 to 5000, in packets per second.

Views

System view

Default Level

2: Configuration level

Task Name and Operations

Task Name Operations
nd write

Usage Guidelines

Usage Scenario

When a device sends an IPv6 packet, if the MAC address corresponding to the destination IPv6 address of the IPv6 packet does not exist, an ND Miss message is generated. This consumes device resources and affects the processing of other services. To resolve this problem, run the ipv6 nd miss anti-attack rate-limit command to configure the rate at which ND Miss messages are sent. With this configuration, the device processes only the allowed number of ND Miss messages within a specified period to ensure normal service running.

Configuration Impact

After the rate at which ND Miss messages are sent is limited, a device collects statistics about the number of received ND Miss messages. If the number of ND Miss messages received within a specified period exceeds the upper limit, the device discards the excess ND Miss messages.

Example

# Configure the rate at which ND Miss messages are sent as 3000.
<HUAWEI> system-view
[~HUAWEI] ipv6 nd miss anti-attack rate-limit 3000
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >