title: ICMP time exceeded in-transit
body: <p>In the last few days my server suffers an attack of this kind:
  (bandwith > 60MBit/s, XXX.XXX.XXX.XXX are multiple IPs)</p>
  
  <pre><code>    tcpdump -n proto ICMP    
      17:15:19.267464 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP time exceeded in-transit, length 36
      17:15:19.325217 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP time exceeded in-transit, length 36
      17:15:19.345561 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP time exceeded in-transit, length 56
      17:15:19.484865 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP time exceeded in-transit, length 36
      17:15:19.529616 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP time exceeded in-transit, length 36
      17:15:19.957058 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP YYY.YYY.YYY.YYY tcp port 39692 unreachable, length 36
      17:15:19.968957 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56
      17:15:20.112520 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 56
      17:15:20.203199 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36
      17:15:20.204803 IP XXX.XXX.XXX.XXX &gt; my_ip: ICMP host YYY.YYY.YYY.YYY unreachable, length 36
  </code></pre>
  
  <p>I've FreeBSD 9.1 and my pf.conf is</p>
  
  <pre><code>ext_if="em0"
  table &lt;blockedips&gt; persist file "/etc/pf-blocked-ips.conf"
  
  set skip on lo0
  
  block drop in log (all) quick on $ext_if from &lt;blockedips&gt; to any
  
  block in
  pass out flags S/SA keep state
  
  pass in on $ext_if proto tcp to port 80 flags S/SA keep state
  pass in on $ext_if proto tcp to port ssh flags S/SA synproxy state
  </code></pre>
  
  <p>There's anything that i can do with pf?</p>