topic Re: DoS Protection - Calls to aspx in General Topics

DoS Protection - Calls to aspx

AmyTyler — Tue, 11 Mar 2014 19:52:10 GMT

Hi,

I am wanting to create a DoS protection rule specific to http uri requests that have /*.aspx (so, the uri is at the root). I was approaching this by creating a custom application with a signature with the following:

pattern match

context: http-req-uri-path

pattern: /*.aspx/*

qualifier: http-method GET

However, this pattern does not meet the 7byte limit.

Is there another/better way to go about this?

Thanks in advance.

Re: DoS Protection - Calls to aspx

HULK — Tue, 11 Mar 2014 20:41:02 GMT

Hello Amy,

Could you please go through the below mentioned documents and try to find an another match which contains at least 7 Byte strings.

Custom Application Signatures

Thanks

Re: DoS Protection - Calls to aspx

AmyTyler — Wed, 12 Mar 2014 17:56:52 GMT

Thanks, Hulk. I'm wanting to match on any URI string ending with .aspx

My challenge is that can be any number of patterns, which is why I wanted to wildcard the leading string.

Is there any easier way to match on aspx (.NET pages)?

Re: DoS Protection - Calls to aspx

AmyTyler — Wed, 19 Mar 2014 17:22:19 GMT

I have worked out the correct regex for pattern matching, however now I am wanting to somehow limit packets per second for any call to aspx web pages. There doesn't appear to be a way to call a custom app in the DoS Protection profile or policy.

Is it possible to limit packets per second to a specific HTTP page request?