Forum Discussion

danielpenna's avatar
Sep 28, 2015

ASM Prevention for Slow HTTP Attacks

Hi Team, I have been reading the article https://support.f5.com/kb/en-us/solutions/public/14000/100/sol14199 after starting to notice these logs files on my F5. Now from the article these are slow HTTP connections being dropped but what I really want to know is:

 

  • What is the threshold for these slow transactions dropping ?
  • And can I find out any information on these dropped transactions ? If these are slow attacks, source IP and destination IP would be handy.

It all seems a bit "under the covers" in regards to what is happening here and I would love to find more information

 

err dcc[13309]: 01310001:3: event code D3554 Slow transactions attack detected - account id: (9), number of dropped slow transactions: (128)

 

err dcc[13309]: 01310001:3: event code D3554 Slow transactions attack detected - account id: (9), number of dropped slow transactions: (2428)