Index: /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c
===================================================================
--- /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 38926)
+++ /trunk/src/VBox/Devices/Network/slirp/ip_icmp.c	(revision 38927)
@@ -89,4 +89,7 @@
 };
 
+static int icmp_cache_count(PNATState pData);
+static void icmp_cache_clean(PNATState pData, int iEntries);
+
 int
 icmp_init(PNATState pData)
@@ -308,4 +311,45 @@
 }
 
+static int icmp_cache_count(PNATState pData)
+{
+    int iIcmpCount = 0;
+    struct icmp_msg *icm = NULL;
+    LogFlowFuncEnter();
+    LIST_FOREACH(icm, &pData->icmp_msg_head, im_list)
+        iIcmpCount++;
+    LogFlowFunc(("LEAVE: %d\n", iIcmpCount));
+    return iIcmpCount;
+}
+/**
+ * iEntries how many entries to leave, if iEntries < 0, clean all
+ */
+static void icmp_cache_clean(PNATState pData, int iEntries)
+{
+    int iIcmpCount = 0;
+    struct icmp_msg *icm = NULL;
+    LogFlowFunc(("iEntries:%d\n", iEntries));
+    if (iEntries > icmp_cache_count(pData))
+    {
+        LogFlowFuncLeave();
+        return;
+    }
+    while(!LIST_EMPTY(&pData->icmp_msg_head))
+    {
+        icm = LIST_FIRST(&pData->icmp_msg_head);
+        if (    iEntries > 0
+            &&  iIcmpCount < iEntries)
+        {
+            iIcmpCount++;
+            continue;
+        }
+
+        LIST_REMOVE(icm, im_list);
+        if (icm->im_m)
+            m_freem(pData, icm->im_m);
+        RTMemFree(icm);
+    }
+    LogFlowFuncLeave();
+}
+
 static int
 icmp_attach(PNATState pData, struct mbuf *m)
@@ -319,4 +363,6 @@
     icm->im_so = m->m_so;
     LIST_INSERT_HEAD(&pData->icmp_msg_head, icm, im_list);
+    if (icmp_cache_count(pData) > 100)
+        icmp_cache_clean(pData, 50);
     return 0;
 }