Troy:
I sympathize with you. I've struggled with the same issue.
The right answer is that there are no particular numbers you should use because each situation is different and each environment has different traffic loads and behavior.
One has to really understand their network's traffic characteristics. For example, do you have technologies deployed that are process switched and cannot be CEF switched? If so, you need to account for that traffic when you apply the policing parameters. A good example of this is DHCP relay traffic under an interface that uses helper addresses. This traffic is process switched.
Moreover, the network's traffic load may spike during recovery after certain kinds of outages, so you have to take that into consideration, too.
The thing to do is to use very liberal numbers at first and leave them in place for a while. Examine the traffic load for each class and begin tuning the numbers from there. There are certain categories of traffic that are pretty safe to be aggressive with, such as fragments and ICMP on the control plane. Fragments should not exist (Data plane, yes. Control plane, no.) and ICMP should be very minimal. And if you have icmp redirects and other such icmp-related functions disabled, you can really be aggressive with the numbers.
HTH
Victor
