[PATCH net-next] icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}

[PATCH net-next] icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}

[Eric Dumazet]

These sysctls were added in 4cdf507d5452 ("icmp: add a global rate
limitation") and their default values might be too small.

Some network tools send probes to closed UDP ports from many hosts
to estimate proportion of packet drops on a particular target.

This patch sets both sysctls to 10000.

Note the per-peer rate-limit (as described in RFC 4443 2.4 (f))
intent is still enforced.

This also increases security, see b38e7819cae9
("icmp: randomize the global rate limiter") for reference.

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 Documentation/networking/ip-sysctl.rst | 6 +++---
 net/ipv4/icmp.c                        | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
index 6921d8594b8493a25d62ffd586d0b9f6527409cb..9434c417085bd2c452ee86945349903761c623bd 100644
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1747,14 +1747,14 @@ icmp_msgs_per_sec - INTEGER
 	controlled by this limit. For security reasons, the precise count
 	of messages per second is randomized.
 
-	Default: 1000
+	Default: 10000
 
 icmp_msgs_burst - INTEGER
 	icmp_msgs_per_sec controls number of ICMP packets sent per second,
-	while icmp_msgs_burst controls the burst size of these packets.
+	while icmp_msgs_burst controls the token bucket size.
 	For security reasons, the precise burst size is randomized.
 
-	Default: 50
+	Default: 10000
 
 icmp_ratemask - INTEGER
 	Mask made of ICMP types for which rates are being limited.
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a62b4c4033ccbaa5f6de1345ab33f89b4096b691..1cf9e391aa0cc18e5d3ef4b6569207ae1ec0e43e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1727,8 +1727,8 @@ static int __net_init icmp_sk_init(struct net *net)
 	net->ipv4.sysctl_icmp_ratemask = 0x1818;
 	net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr = 0;
 	net->ipv4.sysctl_icmp_errors_extension_mask = 0;
-	net->ipv4.sysctl_icmp_msgs_per_sec = 1000;
-	net->ipv4.sysctl_icmp_msgs_burst = 50;
+	net->ipv4.sysctl_icmp_msgs_per_sec = 10000;
+	net->ipv4.sysctl_icmp_msgs_burst = 10000;
 
 	return 0;
 }
-- 
2.53.0.345.g96ddfc5eaa-goog

Re: [PATCH net-next] icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}

[Kuniyuki Iwashima]

On Mon, Feb 23, 2026 at 8:17 AM Eric Dumazet <edumazet@google.com> wrote:
>
> These sysctls were added in 4cdf507d5452 ("icmp: add a global rate
> limitation") and their default values might be too small.
>
> Some network tools send probes to closed UDP ports from many hosts
> to estimate proportion of packet drops on a particular target.
>
> This patch sets both sysctls to 10000.
>
> Note the per-peer rate-limit (as described in RFC 4443 2.4 (f))
> intent is still enforced.
>
> This also increases security, see b38e7819cae9
> ("icmp: randomize the global rate limiter") for reference.
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>

Re: [PATCH net-next] icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 23 Feb 2026 16:17:42 +0000 you wrote:
> These sysctls were added in 4cdf507d5452 ("icmp: add a global rate
> limitation") and their default values might be too small.
> 
> Some network tools send probes to closed UDP ports from many hosts
> to estimate proportion of packet drops on a particular target.
> 
> This patch sets both sysctls to 10000.
> 
> [...]

Here is the summary with links:
  - [net-next] icmp: increase net.ipv4.icmp_msgs_{per_sec,burst}
    https://git.kernel.org/netdev/net-next/c/64db5933c7ad

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html