I'm getting a lot of ICMP throttle messages in my system.log:
Apr 11 20:45:28 kernel: Limiting icmp unreach response from 1054 to 250 packets per second Apr 11 20:45:29 kernel: Limiting icmp unreach response from 529 to 250 packets per second
I found the traffic is coming from a single host by running
sudo tcpdump -ni en0 "icmp=3 and icmp=3"
20:48:32.614241 IP 64.........125 > 185.......98: ICMP 64.......125 udp port 27960 unreachable, length 36 20:48:32.616923 IP 64.......125 > 185.......98: ICMP 64.......125 udp port 27960 unreachable, length 36
64.......125 is my server's IP and I assume
185.......98 is the requester (that's the only IP seen in 1000's of log lines)
I've tried to use
pf to blacklist this IP, block ICMP access to this port (or in general, since it seems like ICMP is not port based?), and tried a custom rule to block:
block drop on en0 inet proto icmp from 64.......125 to 185.......98 block drop on en0 inet proto icmp from 185.......98 to 64.......125
Regardless of all my pf attempts I still see the system.log and tcpdump activity.
Have I properly interpreted the
tcpdump lines? (The carat direction makes it look like it's only outbound packets?)
My understanding was pf blocked the packets from reaching the kernel, so if it was configured properly these messages would go away. Is that correct?
If it's not correct, do I need to take action based on the requests, or should I just follow the instructions for nullifying the log lines?
I'm using IceFloor to configure
pf on OS X 10.8.5, if it's relevant.