Forum Discussion
NimbostratusInquiries about Advanced WAF DoS Protection
Hi All,
The customer using the BIG-IP i2800 with v17.1 has some questions regarding the Advanced WAF "DoS Protection" feature. Hoping you can help me with a few things below:
1. What is the definition of a "transaction" in the following TPS-based DoS Detection configuration?
For example;
1) SYN flood attack case
If 100 pps of SYN packets are received from one source IP, how many transactions will be counted?
2) Smurf attack case
If 1,000 pps of spoofed ICMP packets are received from one source IP, how many transactions will be counted?
2. After the number of malicious transactions reaches the threshold configured above and the mitigation/blocking action is triggered, under what conditions will this action be automatically lifted? Also, is it possible to manually lift the action once it has been triggered?
3. When identifying the source IP with the X-Forwarded-For (XFF) field in the HTTP request header, which IP address will be subject to the mitigation/blocking action if multiple IP addresses are listed in the XFF field? Is it only the first original client IP?
X-Forwarded-For: <client_IP>, <proxy1_IP>, <proxy2_IP> ...
Thanks in advance,
Shinichi
4 Replies
- Injeyan_Kostas
Cumulonimbus
As you're referring to Advanced WAF, it's important to note that it only addresses Layer 7 (L7) DDoS attacks, where 1 HTTP request is considered as 1 transaction.
Attacks such as SYN floods or Smurf (ICMP) attacks are not handled by Advanced WAF, as they occur at lower layers. For these types of attacks, you should consider using LTM (for basic TCP protection) or AFM (for full Layer 3/4 DoS protection).
In such cases, each SYN or ICMP packet is counted as 1 transaction.Mitigation is automatically lifted once the TPS rate drops below the configured threshold.
Regarding X-Forwarded-For (XFF) headers, ASM uses the first IP address in the list
Shinichi_KawaiThanks for the quick reply, Injeyan! Here is my understanding:
- 1 HTTP request (L7) is counted as 1 transaction.
- Advanced WAF does not handle lower layers information such as TCP headers (L4) and IP headers (L3).Q2 and Q3 are now clear as well.
- Injeyan_Kostas
Yes 1 Http request is 1 transaction
Waf itself is handling only L7. BIG-IP though has also some LTM funcionaltites even when only Waf is provisioned which you can use like SYN cookie protection.
- Shinichi_Kawai
Thanks Injeyan for the additional comment!
I will propose some effective LTM functionalities along with adding the Advanced WAF DoS Protection feature.
Since the customer has been experiencing DoS attacks about twice a month, they’re hoping to quickly implement protection using their existing BIG-IP i2800.
