ICMP时间超过了在途

-2

在过去的几天我的服务器遭受这样的攻击：（带宽> 60MBit /秒，XXX.XXX.XXX.XXX是多个IP）ICMP时间超过了在途

tcpdump -n proto ICMP  
    17:15:19.267464 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36 
    17:15:19.325217 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36 
    17:15:19.345561 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 56 
    17:15:19.484865 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36 
    17:15:19.529616 IP XXX.XXX.XXX.XXX > my_ip: ICMP time exceeded in-transit, length 36 
    17:15:19.957058 IP XXX.XXX.XXX.XXX > my_ip: ICMP YYY.YYY.YYY.YYY tcp port 39692 unreachable, length 36 
    17:15:19.968957 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56 
    17:15:20.112520 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56 
    17:15:20.203199 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36 
    17:15:20.204803 IP XXX.XXX.XXX.XXX > my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36

我FreeBSD 9.1和我的pf.conf是

ext_if="em0" 
table <blockedips> persist file "/etc/pf-blocked-ips.conf" 

set skip on lo0 

block drop in log (all) quick on $ext_if from <blockedips> to any 

block in 
pass out flags S/SA keep state 

pass in on $ext_if proto tcp to port 80 flags S/SA keep state 
pass in on $ext_if proto tcp to port ssh flags S/SA synproxy state

有什么我可以用pf做的吗？

来源

2013-04-23 mattia