On Mar 25, 2010, at 3:59 AM, Gert Doering wrote:
> so this is something that needs to work on customer-facing interfaces, with
> some amount of rate-limiting ("customer can ping with 100 kbit/s, but no
> more"). One interesting side-effect currently is that if customer "A"
> fills the ICMP-ping-untrusted CoPP limit, customer "B" starts complaining
> because they see ping packets to their interface get dropped...
+1 - to the suggestion/implication that this *should* be parallelized, becoming
more of a per-interface (svi, subint, port, port-channel subint, pos,
pos-channel, (gre, te) tunnel, etc) rate-limiter versus a global, single-bucket
rate-limiter. Perhaps the microflow policing concept (or something like it)
could be repurposed here.
>> If that's what you want..wanna help me push for it? ;)
>
> If we can refine that a bit more, happy to do so.
An auto-built /32 ACL + individual policer per-receive adj address should
suffice, speaking in terms of 'implementation' on the box.
-Tk
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
