Forum Discussion

neeeewbie's avatar
neeeewbie
Icon for MVP rankMVP
Mar 20, 2020
Solved

Can I counting Syn packet ??

Hi guys

I want to block syn flooding using irule

 

So, my plan is counting syn flooding base of source and destination IP

 

set src and dst and set max-request and time

 

but I don't know how to count syn ..

 

Let me know it if you know how to count syn packet

 

thank you

 

application delivery
BIG-IP
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Mar 20, 2020

    Hello.

     

    There exists an iRule event that you can use to count TCP Sync packets

    https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

     

    Don't forget to test it in lab before moving to production.

    This event has some bugs that could make you crash your TMM.

    • https://cdn.f5.com/product/bugtracker/ID706505.html
    • https://cdn.f5.com/product/bugtracker/ID643396.html
    • https://cdn.f5.com/product/bugtracker/ID612874.html
    • https://cdn.f5.com/product/bugtracker/ID497115.html

     

    KR,

    Dario.

2 Replies

Sort By
  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for MVP rankMVP
    Mar 20, 2020

    Hello.

     

    There exists an iRule event that you can use to count TCP Sync packets

    https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

     

    Don't forget to test it in lab before moving to production.

    This event has some bugs that could make you crash your TMM.

    • https://cdn.f5.com/product/bugtracker/ID706505.html
    • https://cdn.f5.com/product/bugtracker/ID643396.html
    • https://cdn.f5.com/product/bugtracker/ID612874.html
    • https://cdn.f5.com/product/bugtracker/ID497115.html

     

    KR,

    Dario.

  • PeteWhite's avatar
    PeteWhite
    Icon for Employee rankEmployee
    Mar 20, 2020

    You can't do it - syn cookies do a better job and if you have a standard VS then it will take care of it anyway because it is a full proxy ie it will only create a server-side connection when the client-side connection is setup. You can also look at dos profiles with AFM and possibly ASM.