Sep 2026 - DevCentral will be set to Read-Only on Sep 14th for a platform update. Details: DevCentral is Evolving.

Forum Discussion

Esteban_Araya_3's avatar
Esteban_Araya_3
Icon for Nimbostratus rankNimbostratus
Feb 08, 2019

Irule for DDOs Attacks!

Hello,   I´m working with a client that is getting DD0s attacks from random IPs. We have some limitations with the Hardware as we only have an ASA and the F5 but no additional security modules, an...
application delivery
big-ip
irules
security
Rico's avatar
Rico
Icon for Cirrus rankCirrus
Feb 08, 2019

Your iRule should work except for the fact that you are checking for an uppercase string in a lowercase string.

if { [string tolower [HTTP::uri]] contains "UNION%20SELECT%20" } {

Should be

if { [string tolower [HTTP::uri]] contains "union%20select%20" } {

Here is some additional information on how to help mitigate DDoS attacks with the LTM module.

F5 also has their Silverline product which could help. I figured I would mention it though I understand that the client may have restrictions.