diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -154,8 +154,13 @@
 	if (icmpprintfs)
 		kprintf("icmp_error(%p, %d, %d)\n", oip, type, code);
 #endif
-	if (type != ICMP_REDIRECT)
+	if (type != ICMP_REDIRECT) {
 		icmpstat.icps_error++;
+#ifdef ICMP_BANDLIM
+		if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
+			goto freeit;
+#endif
+	}
 	/*
 	 * Don't send error if the original packet was encrypted.
 	 * Don't send error if not the first fragment of message.