Forum Discussion

Hoang_Hung's avatar
Hoang_Hung
Icon for Cirrus rankCirrus
Aug 08, 2020

Different between Dos Protection and Bot Defense

Hi all

We have 2 question for ASM F5:

  1. What is different between DoS Protection and Bot Defense . Why F5 need use 2 separation it. ( attach picture version BIG-IP: 15.1)
  2. If we use Dos protection with TPS-based Detection and Bahabioral & Stress : by Thresholds Mode : is Automatic. then how do you do calculate with value for block attack if we use automactic

Thank all

Hung Hoang

please explain hep me

 

 

 

 

ASM Advanced WAF
F5 Rules for AWS WAF
security

2 Replies

Sort By
  • Ivan_Chernenkii's avatar
    Ivan_Chernenkii
    Icon for Employee rankEmployee
    Aug 11, 2020

    Hello Hoang,

     

    1. Bots aren't always execute DoS attack to application. They can execute scraping, scalping, skewing, sniping and etc. These attack aren't always connected with high-rate traffic, like mostly in case of DoS. Also, it is good to have functionality to classify bots as good or bad. That is why ASM has these two different solutions: DoS Protection and Bot Defense.
    2. In case of "Automatic" mode ASM constantly counts baseline threshold, based on incoming traffic, and if baseline threshold is significantly reached, then it detects DoS attack. For more details you can look at https://techdocs.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-13-0-0/1.html.

     

    Thanks, Ivan