For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

neeeewbie's avatar
neeeewbie
Icon for MVP rankMVP
Mar 20, 2020
Solved

Can I counting Syn packet ??

Hi guys I want to block syn flooding using irule   So, my plan is counting syn flooding base of source and destination IP   set src and dst and set max-request and time   but I don't k...
application delivery
BIG-IP
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Mar 20, 2020

    Hello.

     

    There exists an iRule event that you can use to count TCP Sync packets

    https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

     

    Don't forget to test it in lab before moving to production.

    This event has some bugs that could make you crash your TMM.

    • https://cdn.f5.com/product/bugtracker/ID706505.html
    • https://cdn.f5.com/product/bugtracker/ID643396.html
    • https://cdn.f5.com/product/bugtracker/ID612874.html
    • https://cdn.f5.com/product/bugtracker/ID497115.html

     

    KR,

    Dario.

PeteWhite's avatar
PeteWhite
Icon for Employee rankEmployee
Mar 20, 2020

You can't do it - syn cookies do a better job and if you have a standard VS then it will take care of it anyway because it is a full proxy ie it will only create a server-side connection when the client-side connection is setup. You can also look at dos profiles with AFM and possibly ASM.