Forum Discussion

Renato_Abreu's avatar
Renato_Abreu
Icon for Altostratus rankAltostratus
Feb 04, 2020
Solved

Source IP logging for AFM DDoS attacks

Hello everyone.   I'm configuring AFM DDoS Device Protection and using local-db-publisher for logging. Looking at the events generated when AFM detects an attack, I can only see the destination...
AFM
security
  • Simon_Blakely's avatar
    Simon_Blakely
    Feb 04, 2020

    The answer is in the name - DDoS Device Protection

     

    The identified attacks are from multiple distributed source IPs, all targeted at a Destination IP.

    Because of the distributed nature of the attack, the large number of Source IPs are considered not relevant, and so are not logged.

Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Feb 04, 2020

The answer is in the name - DDoS Device Protection

 

The identified attacks are from multiple distributed source IPs, all targeted at a Destination IP.

Because of the distributed nature of the attack, the large number of Source IPs are considered not relevant, and so are not logged.