you are testing with higher maximums, you need to ensure that the ICMP traffic volume exceeds the configured
maximum.
When testing ICMP rate-limiting where inbound ICMP traffic on a given interface has destinations on multiple
outbound interfaces, the test results must be based on the received outbound ICMP traffic.
ICMP rate-limiting is not reflected in counters monitoring inbound traffic because inbound packets are counted
before the ICMP rate-limiting drop action occurs.
ICMP rate-limiting trap and Event Log messages
If the switch detects a volume of inbound ICMP traffic on a port that exceeds the ICMP rate-limit configured for
that port, it generates one SNMP trap and one informational Event Log message to notify the system operator of
the condition. (The trap and Event Log message are sent within two minutes of when the event occurred on the
port.) For Example:
I 06/30/05 11:15:42 RateLim: ICMP traffic exceeded configured limit on port A1
These trap and Event Log messages provide an advisory that inbound ICMP traffic on a given interface has
exceeded the configured maximum. The additional ICMP traffic is dropped, but the excess condition may indicate
an infected host (or other traffic threat or network problem) on that interface. The system operator should
investigate the attached devices or network conditions further; the switch does not send more traps or Event Log
messages for excess ICMP traffic on the affected port until the system operator resets the port's ICMP trap
function.
The switch does not send more traps or Event Log messages for excess ICMP traffic on the affected port until the
system operator resets the port’s ICMP trap function. The reset can be done through SNMP from a network
management station or through the CLI with the trap-clear command option.
Syntax:
interface <port-list> rate-limit icmp trap-clear
On a port configured with ICMP rate-limiting, this command resets the ICMP trap function, which allows the switch
to generate a new SNMP trap and an Event Log message if ICMP traffic in excess of the configured limit is
detected on the port.
Example:
An operator noticing an ICMP rate-limiting trap or Event Log message originating with port 1 on a switch would
use the following command to reset the port to send a new message if the condition occurs again:
HP Switch(config)# interface 1 rate-limit icmp trap-clear
Determining the switch port number used in ICMP port reset commands
To enable excess ICMP traffic notification traps and Event Log messages, use the setmib command described
on
ICMP rate-limiting trap and Event Log messages on page 130. The port number included in the command
corresponds to the internal number the switch maintains for the designated port and not the port's external
identity.
To match the port's external slot/number to the internal port number, use the walkmib ifDescr command, as
shown in the following example:
Matching internal port numbers to external port numbers
switch# walkmib ifDescr
ifDescr.1 = 1
ifDescr.2 = 2
ifDescr.3 = 3
ifDescr.4 = 4
130 Aruba 2530 Management and Configuration Guide for
ArubaOS-Switch 16.05
To Next Page