There are multiple ICMP rate limiting mechanisms: * Global limits: net.ipv4.icmp_msgs_burst/icmp_msgs_per_sec * v4 per-host limits: net.ipv4.icmp_ratelimit/ratemask * v6 per-host limits: net.ipv6.icmp_ratelimit/ratemask However, when ICMP output is limited, there is no way to tell which limit has been hit or even if the limits are responsible for the lack of ICMP output. Add counters for each of the cases above. As we are within local_bh_disable(), use the __INC stats variant. Example output: # nstat -sz "*RateLimit*" IcmpOutRateLimitGlobal 134 0.0 IcmpOutRateLimitHost 770 0.0 Icmp6OutRateLimitHost 84 0.0
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -95,6 +95,8 @@ enum · 94 unmodified lines | |||
| 95 | ICMP_MIB_OUTADDRMASKS, /* OutAddrMasks */ | 95 | ICMP_MIB_OUTADDRMASKS, /* OutAddrMasks */ |
| 96 | ICMP_MIB_OUTADDRMASKREPS, /* OutAddrMaskReps */ | 96 | ICMP_MIB_OUTADDRMASKREPS, /* OutAddrMaskReps */ |
| 97 | ICMP_MIB_CSUMERRORS, /* InCsumErrors */ | 97 | ICMP_MIB_CSUMERRORS, /* InCsumErrors */ |
| 98 | ICMP_MIB_RATELIMITGLOBAL, /* OutRateLimitGlobal */ | ||
| 99 | ICMP_MIB_RATELIMITHOST, /* OutRateLimitHost */ | ||
| 98 | __ICMP_MIB_MAX | 100 | __ICMP_MIB_MAX |
| 99 | }; | 101 | }; |
| 100 | 102 | ||
| @@ -112,6 +114,7 @@ enum · 11 unmodified lines | |||
| 112 | ICMP6_MIB_OUTMSGS, /* OutMsgs */ | 114 | ICMP6_MIB_OUTMSGS, /* OutMsgs */ |
| 113 | ICMP6_MIB_OUTERRORS, /* OutErrors */ | 115 | ICMP6_MIB_OUTERRORS, /* OutErrors */ |
| 114 | ICMP6_MIB_CSUMERRORS, /* InCsumErrors */ | 116 | ICMP6_MIB_CSUMERRORS, /* InCsumErrors */ |
| 117 | ICMP6_MIB_RATELIMITHOST, /* OutRateLimitHost */ | ||
| 115 | __ICMP6_MIB_MAX | 118 | __ICMP6_MIB_MAX |
| 116 | }; | 119 | }; |
| 117 | 120 | ||