Forum Discussion

neeeewbie's avatar
neeeewbie
Icon for MVP rankMVP
Mar 20, 2020
Solved

Can I counting Syn packet ??

Hi guys I want to block syn flooding using irule   So, my plan is counting syn flooding base of source and destination IP   set src and dst and set max-request and time   but I don't k...
application delivery
BIG-IP
iRules
  • Dario_Garrido's avatar
    Dario_Garrido
    Mar 20, 2020

    Hello.

     

    There exists an iRule event that you can use to count TCP Sync packets

    https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

     

    Don't forget to test it in lab before moving to production.

    This event has some bugs that could make you crash your TMM.

    • https://cdn.f5.com/product/bugtracker/ID706505.html
    • https://cdn.f5.com/product/bugtracker/ID643396.html
    • https://cdn.f5.com/product/bugtracker/ID612874.html
    • https://cdn.f5.com/product/bugtracker/ID497115.html

     

    KR,

    Dario.

Dario_Garrido's avatar
Dario_Garrido
Icon for MVP rankMVP
Mar 20, 2020

Hello.

 

There exists an iRule event that you can use to count TCP Sync packets

https://clouddocs.f5networks.net/api/irules/FLOW_INIT.html

 

Don't forget to test it in lab before moving to production.

This event has some bugs that could make you crash your TMM.

  • https://cdn.f5.com/product/bugtracker/ID706505.html
  • https://cdn.f5.com/product/bugtracker/ID643396.html
  • https://cdn.f5.com/product/bugtracker/ID612874.html
  • https://cdn.f5.com/product/bugtracker/ID497115.html

 

KR,

Dario.