ddos zone-template tcp progression-tracking mitigation slow-attack¶

Configure and enable TCP progression Tracking Mitigation for slow attack (identify slow attacker)

slow-attack Specification¶

Parameter Value

Type Configuration Resource

Element Name slow-attack

Element URI /axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack

Element Attributes slow-attack_attributes

Partition Visibility shared

Schema slow-attack schema

Operations Allowed:

Operation	Method	URI	Payload
Create Object	POST	/axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack	slow-attack attributes
POST /axapi/v3/ddos/zone-template/tcp/a/progression-tracking/mitigation/slow-attack Payload: { "slow-attack": { "slow-attack": "enable-check", "init-response-max-time": 2 } }
Get Object	GET	/axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack	slow-attack attributes
GET /axapi/v3/ddos/zone-template/tcp/a/progression-tracking/mitigation/slow-attack Reponse: { "slow-attack": { "slow-attack": "enable-check", "init-response-max-time": 2, "progression-tracking-slow-action": "drop", "uuid": "854c12da-0892-11f0-b674-001fa04507c0", "a10-url": "/axapi/v3/ddos/zone-template/tcp/a/progression-tracking/mitigation/slow-attack" } }
Modify Object	POST	/axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack	slow-attack attributes
Replace Object	PUT	/axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack	slow-attack attributes
PUT /axapi/v3/ddos/zone-template/tcp/a/progression-tracking/mitigation/slow-attack Payload: { "slow-attack": { "slow-attack": "enable-check", "init-response-max-time": 3 } }
Delete Object	DELETE	/axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack	slow-attack attributes
DELETE /axapi/v3/ddos/zone-template/tcp/a/progression-tracking/mitigation/slow-attack Reponse: { "response": { "http-status": 200, "status": "OK", "msg": "Success" } }

slow-attack attributes¶

init-request-max-time

Description Set client query time (in unit of 100ms). Suggested value larger than 30 secs

Type: number

Range: 2-6000

init-response-max-time

Description Set server think time (in unit of 100ms). Suggested value larger than 45 secs

Type: number

Range: 2-6000

progression-tracking-slow-action

Description ‘drop’: Drop packets for progression tracking violation exceed (Default); ‘reset’: Reset client connection; ‘blacklist-src’: Blacklist-src for progression tracking violation exceed;

Type: string

Supported Values: drop, reset, blacklist-src

Default: drop

Mutual Exclusion: progression-tracking-slow-action and progression-tracking-slow-action-list-name are mutually exclusive

progression-tracking-slow-action-list-name

Description Configure action-list to take when progression tracking violation exceed

Type: string

Format: string-rlx

Maximum Length: 63 characters

Maximum Length: 1 characters

Mutual Exclusion: progression-tracking-slow-action-list-name and progression-tracking-slow-action are mutually exclusive

Reference Object: /axapi/v3/ddos/action-list

response-pkt-rate-max

Description Set the transferred packets per response

Type: number

Range: 1-255

slow-attack

Description ‘enable-check’: Enter Progression Tracking Tracking Slow Attack;

Type: string

Supported Values: enable-check

Default: enable-check

slow-attacker-identification

Description: slow-attacker-identification is a JSON Block. Please see below for slow-attacker-identification

Type: Object

Reference Object: /axapi/v3/ddos/zone-template/tcp/{name}/progression-tracking/mitigation/slow-attack/slow-attacker-identification

uuid

Description uuid of the object

Type: string

Maximum Length: 64 characters

Maximum Length: 1 characters

slow-attacker-identification¶

Specification Value

Type object

active-connection

Description Set the minimum tracking active connection to start identifying slow attacker, default value is 3

Type: number

Range: 1-65535

Default: 3

bad-connection

Description Set the maximum percentage of slow connection (per source), default value is 75

Type: number

Range: 1-100

Default: 75

enable-identification

Description Progression tracking will identify slow attacker and blacklist it based on the config value

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

uuid

Description uuid of the object

Type: string

Maximum Length: 64 characters

Maximum Length: 1 characters