ipv6 nd na anti-attack rate-limit

Function

The ipv6 nd na anti-attack rate-limit command configures the rate at which Neighbor Advertisement (NA) messages are sent, that is, the number of ND messages allowed to be processed per second.

The undo ipv6 nd na anti-attack rate-limit command restores the default configuration.

By default, 550 NA messages are sent per second.

Format

ipv6 nd na anti-attack rate-limit limit-number

undo ipv6 nd na anti-attack rate-limit limit-number

undo ipv6 nd na anti-attack rate-limit

Parameters

Parameter Description Value
limit-number

Specifies the rate at which NA messages are sent.

The value is an integer in the range of 1 to 5000, in packets per second.

Views

System view

Default Level

2: Configuration level

Task Name and Operations

Task Name Operations
nd write

Usage Guidelines

Usage Scenario

When a device is under an attack, a large number of NA messages are received within a short period of time. As a result, lots of CPU resources are used in neighbor entry learning and response, which affects the processing of other services. To resolve this problem, run the ipv6 nd na anti-attack rate-limit command to configure the rate at which NA messages are sent. With this configuration, when the number of NA messages received exceeds the specified threshold, the device discards the excess NA messages.

Example

# Configure the rate at which NA messages are sent as 3000.
<HUAWEI> system-view
[~HUAWEI] ipv6 nd na anti-attack rate-limit 3000
Parent Topic: IPv6 ND Configuration Commands
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >