iptables, so you are implying linux (at least as an example for an OS with tunable network policies).
Since a very long time, linux has had a limit on the number of ICMP error message sent. The default is very low: 1 message/s.
This behaviour of linux is tunable with network
sysctl parameters: the icmp_ratelimit sysctl
icmp_ratelimit - INTEGER
Limit the maximal rates for sending ICMP packets whose type matches
icmp_ratemask (see below) to specific targets.
0 to disable any limiting,
otherwise the minimal space between responses in milliseconds.
Note that by default
icmp_ratelimit only applies to ICMP error messages and source quench, not all ICMP replies:
icmp_ratemask - INTEGER
Mask made of ICMP types for which rates are being limited.
Significant bits: IHGFEDCBA9876543210
Default mask: 0000001100000011000 (6168)
Bit definitions (see include/linux/icmp.h):
0 Echo Reply
3 Destination Unreachable *
4 Source Quench *
8 Echo Request
B Time Exceeded *
C Parameter Problem *
D Timestamp Request
E Timestamp Reply
F Info Request
G Info Reply
H Address Mask Request
I Address Mask Reply
* These are rate limited by default (see default mask above)
so this rate limiting does not apply to echo reply by default.
With the default settings, DOSing a target with ICMP error messages sent by a linux box seems very hard.
The (...) ICMP unreachable packets are very small
No, they are not always tiny: under linux, the ICMP error message will capture as much as possible context from the packet that caused it, up to the 576 (or the destination MTU), to make it possible to demultiplex the error message even when complex encapsulation in IP have been used, following RFC 1812:
22.214.171.124 Original Message Header
Historically, every ICMP error message has included the Internet
header and at least the first 8 data bytes of the datagram that
triggered the error. This is no longer adequate, due to the use of
IP-in-IP tunneling and other technologies. Therefore, the ICMP
datagram SHOULD contain as much of the original datagram as possible
without the length of the ICMP datagram exceeding 576 bytes.