Rate limiting UDP,Multicast,ICMP

Tue Nov 13 17:42:01 UTC 2001

A little more information.  We sell 100Mb Ethernet pipes to the Internet.
(Yes, there are a few of us left).  A fair number of these customers are
small businesses.  Usually, they have servers but very little IT support and
even less IT know how.  My thought is to rate limit UDP and ICMP at the
customer port to no more than 3Mb/s so WHEN (not if) a customer is
compromised, the effects are somewhat limited and my MAN pipes have some
measure protection.  The question is, what am I not thinking of?  DNS, TFTP
and such should all operate virtually unaffected, as they are not bandwidth
hungry services.

Thomas