For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

neeeewbie's avatar
neeeewbie
Icon for MVP rankMVP
Mar 20, 2020
Solved

Can I counting Syn packet ??

Hi guys I want to block syn flooding using irule   So, my plan is counting syn flooding base of source and destination IP   set src and dst and set max-request and time   but I don't k...
application delivery
BIG-IP
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Mar 20, 2020

    Hello.

     

    There exists an iRule event that you can use to count TCP Sync packets

    https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

     

    Don't forget to test it in lab before moving to production.

    This event has some bugs that could make you crash your TMM.

    • https://cdn.f5.com/product/bugtracker/ID706505.html
    • https://cdn.f5.com/product/bugtracker/ID643396.html
    • https://cdn.f5.com/product/bugtracker/ID612874.html
    • https://cdn.f5.com/product/bugtracker/ID497115.html

     

    KR,

    Dario.

Dario_Garrido's avatar
Dario_Garrido
Icon for Noctilucent rankNoctilucent
Mar 20, 2020

Hello.

 

There exists an iRule event that you can use to count TCP Sync packets

https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

 

Don't forget to test it in lab before moving to production.

This event has some bugs that could make you crash your TMM.

  • https://cdn.f5.com/product/bugtracker/ID706505.html
  • https://cdn.f5.com/product/bugtracker/ID643396.html
  • https://cdn.f5.com/product/bugtracker/ID612874.html
  • https://cdn.f5.com/product/bugtracker/ID497115.html

 

KR,

Dario.