> I believe the right way (quick solution for 1.5) is the second one.
> we cannot really trust local traffic (local traffic does not fill
> network bandwidth, however, it still chews CPU time) so the first 
> one will be ruled out.  Is it okay if I make the following changes:
> - tcp_input to use ppsratelimit(9), instead of ratelimit(9)
> and also,
> - remove "loopback is okay" code from IPv4 ICMP error rate limitation.

That sounds reasonable to me.

--jhawk