Prevent ftp brute force attack using irules.

There are a few different approaches you could try, but the one you outlined above is probably the simplest. Since there is no host header readily available via TMM's inpsection engine, when dealing with an FTP connection, you'll need to use the TCP::collect and TCP::payload commands to collect and inspect the payload data, but you should be able to accomplish basically the same thing as you would with HTTP connections.

 

 

When the connection comes in, collect some data, inspect it to find out what host name the request is intended for. If it doesn't match one of your domains, toss it.

 

 

If you need some help getting started, let us know.

 

 

Colin