topic Re: SYN Flood in General Topics

SYN Flood

wlu — Tue, 25 Jan 2011 15:46:04 GMT

hi : I have a question in regard to Flood Protection Thresholds under Zone Protection. Do the thresholds for Alert/Activate/Maximum apply to counting SYN packets directed at a partuicular host or to counting SYN packets directed at all the hosts in the protected zone.

The online documentatio specifies "destination" which implies a particular IP while the the Zore Protection Guide specifies "destination zone" which implies something else.

Thanks

Re: SYN Flood

gafrol — Tue, 25 Jan 2011 17:11:24 GMT

Hi,

to my knwoledge you can apply protection profiles to zones only.

rgds

Roland

Re: SYN Flood

mharding — Tue, 25 Jan 2011 17:13:28 GMT

In my testing, it applied to the zones.

You can view the counters in the CLI with the command show zone-protection zone zone-name

Re: SYN Flood

wlu — Tue, 25 Jan 2011 18:44:27 GMT

hi : The reason I asked my question was that I thought that SYN flood protection was for individual hosts like web servers rather than protection for a zone. If I set alert/activate/maximum thresholds at 10000/10000/40000 and if these numbers apply to the total number of SYN Flood packets sent to a zone/sec then it does not help me if my web server goes belly up after 9000 SYN flood packets/sec. Thanks.

Re: SYN Flood

gafrol — Tue, 25 Jan 2011 18:59:59 GMT

absolutely, I agee and understand your requirement. I just know PAN is working on this to make it more granular maybe in 4.0 ?

https://live.paloaltonetworks.com/message/3207#3207

rgds

Roland