| 	  so, here's ppsratecheck(9).  it basically try to limit some
| 	  event (like icmp6 error transmission) to happen less than X
| 	  occurrences-per-second.

I like this. 

| /*
|  * ppsratecheck(): packets (or events) per second limitation.
|  */
| int
| ppsratecheck(lasttime, curpps, maxpps)
|	 struct timeval *lasttime;
|	 int *curpps;
|	 int maxpps;	/* maximum pps allowed */

Is there a good reason that we are limitting this to events/second? Might
it not be more reasonable to allow the period to be configurable,
i.e. "100 events in 10 seconds" rather than "10 pps"?

+ 	if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
+ 	    delta.tv_sec > 0) {

I think this would be clearer if the last clause were written
as ``delta.tv_sec >= 1'', because it is one second (or more)
that we're testing for.

--jhawk