;COMMENT: Dynamic denial of incoming pings
;DESCRIPTION: Deny (blacklist) incoming ICMP Echo messages after receiving 20 pings within 10 minutes. The blacklisting period is set to 4 hours.

ICMP-Limit-Blacklist
		Comment = "Deny incoming ICMP Echo after receiving 20 pings within 10 minutes",
		Rule-Action = Observe,
		Observation-Period = "00:10",
		Observe-Match-Count = 19,
		Protocol = ICMP,
		ICMP-Type = Echo,
		Direction = Incoming,
		Blacklist-Rule = "ICMP-Limit-Template",
		Blacklist-Period = "04:00",

ICMP-Limit-Template	
		Rule-Status = Passive,
		Rule-Action = Deny,
		Protocol = ICMP,
		ICMP-Type = Echo,
		Direction = Incoming,
