Hello,
Currently I’m facing an issue with the following rule:
/ip firewall filter
add action=return dst-limit=10,5,src-and-dst-address chain=forward protocol=icmp icmp-options=8:0
It’s my understanding that dst-limit works like this:
First parameter is number of packet, since I’ve not specified the time interval, then it means 10 packets per second, second parameter indicates that it must start counting only after the first 5 packets are “seen”, and src-and-dst is are the parameters used to identify each flow (so each flow is checked against this rule), the rule should only activate on a per-flow basis when said flow is below 10 Packets Per second not counting on the first 5 (on this particular case) am I correct?
If I’m correct, then why when the rule is in place, doesn’t matter if ICMP 8:0 PPS is 100, 2, 10 or even 1000 (received by the router), it triggers?
If I’m not correct, please do tell me what am I doing wrong,