DDoS Mitigation With BIG-IP AFM

In a list of attack vectors that you would NOT want to see aimed at your network, a Distributed Denial of Service (DDoS) attack would most certainly make anyone’s top ten.  DDoS has been a hot to...
Published Mar 29, 2016
Version 1.0
AFM
ddos
security
series-devcentral-basics

Was this article helpful?

zack's avatar
zack
Icon for Altostratus rankAltostratus
Apr 15, 2019

Hi John,

 

I know this is a really late question but I am checking/learning AFM but quite confused regarding “Rate Increase”.

 

To "Rate Increase" ( "Dectection %" in newer versions), does AFM really drops/rate limits packets when traffic over that percentage? Because in:

 

https://support.f5.com/kb/en-us/products/big-ip-afm/manuals/product/dns-dos-firewall-implementations-12-1-0/2.html

 

" From the Detection Threshold Percent list, select Specify or Infinite. Use Specify to set a value (in percentage of traffic) for the attack detection threshold. If packets of the specified types cross the percentage threshold, an attack is logged and reported. The system continues to check every second, and registers an attack for the duration that the threshold is exceeded. "

 

So it sounds AFM just report but won't drop packets when traffic over the percentage threshold. Is it correct or any behavior change in v13 or v14?