Always accept ICMP ping replies.

Any IP address sending an ICMP ping request is added to the pingflood list.

When an IP in the pingflood list sends an ICMP ping request, drop the request if that IP has sent five ping requests in one second.

Accept all other ICMP ping requests.

ICMP redirect datagrams for the network are rate-limited to one per second.

ICMP redirect datagrams for the host are rate-limited to one per second.

ICMP destination unreachable messages are rate-limited to one per second.

ICMP time exceeded messages are rate-limited to one per second.

ICMP bad IP header messages are rate-limited to one per second.

Drop all other ICMP packets.