10-07-2013 01:21 PM
I'm trying to figure out the best settings for TCP (SYN) and UDP flood protection for our firewalls, but I'm struggling because I can't find the data I need. I found "New connection established rate" with the "show session info" command; however, I'm assuming this is for TCP and UDP combined. Since these are broken apart in flood protection, I need them separately in the data, as well. To properly protect against floods without overly limiting the number of new connections, I need a total in the Maximum setting for both TCP and UDP that does not go over the stated maximum of the firewall, but also accurately reflects the connections per second (cps) for each IP protocol (TCP and UDP).
The only way I can think to get a reasonable estimate for each cps is to look at the number of active UDP and TCP sessions and make a ratio out of that, then set the Maximum value (and maybe Alert and Activate) based on that ratio. I'd rather find the actual cps for TCP and UDP separately.
Thoughts?
10-07-2013 05:43 PM
Hello mhar,
Considering what you are trying to achieve, monitoring the active sessions to speculate on the maximum, alert and activate values for setting up the tcp and udp flood protection would be your best bet.
Regards
Tilak
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
