About sib2017

  Hi,     Below is  output of  'show counter global filter category flow aspect dos'    What does it mean by value and rate . Does it mean '143291' packets dropped ?        name value rate severity category aspect             flow_dos_red_tcp 1143291 0 drop flow dos flow_dos_pf_ipfrag 57444 0 drop flow dos flow_dos_pf_icmplpkt 1100 0 drop flow dos flow_dos_pf_tcpoverlappingmismatch 20411 0 drop flow dos flow_dos_zone_red_max 446965 0 drop flow dos flow_dos_zone_red_act 696326 0 drop flow dos flow_dos_rule_drop 403117 0 drop flow dos flow_dos_rule_drop_classified 403117 0 drop flow dos flow_dos_rule_allow_under_rate 3402693 0 info flow dos flow_dos_rule_allow 35492603 21 info flow dos flow_dos_rule_match 39298413 22 info flow dos flow_dos_rule_nomatch 129318926 32 info flow dos flow_dos_no_empty_entp 517212 0 info flow dos flow_dos_curr_sess_add_no_entp 114095 0 info flow dos flow_dos_curr_sess_del_no_entp 124207 0 info flow dos flow_dos_cl_curr_sess_add_incr 72234191 27 info flow dos flow_dos_cl_curr_sess_del_decr 72222602 28 info flow dos     Thanks   ... View more

Hi The following report shows incomplete Database: Traffic Log Columns: Source Zone, Source Address, Source Port, Destination Zone, Destination Address, Destination Port, Application, Bytes Query Builder: (app eq incomplete) and (port.dst leq 1023) but the " show counter global filter category flow aspect dos " does not give any indication of drops   name value rate severity category aspect description     flow_dos_red_tcp 1143291 0 drop flow dos Packets dropped: Zone protection protocol 'tcp-syn' RED flow_dos_pf_ipfrag 60010 0 drop flow dos Packets dropped: Zone protection option 'discard-ip-frag' flow_dos_pf_icmplpkt 1100 0 drop flow dos Packets dropped: Zone protection option 'discard-icmp-large-packet' flow_dos_pf_tcpoverlappingmismatch 21198 0 drop flow dos Packets dropped: Zone protection option 'discard-overlapping-tcp-segment-mismatch' flow_dos_zone_red_max 446965 0 drop flow dos Packets dropped: Maximal zone RED threshold reached flow_dos_zone_red_act 696326 0 drop flow dos Packets dropped: Activate zone RED threshold reached, random early drop flow_dos_rule_drop 412022 0 drop flow dos Packets dropped: Rate limited or IP blocked flow_dos_rule_drop_classified 412022 0 drop flow dos Packets dropped: due to classified rate limiting                     So how can i co-relate ? Thanks   ... View more

Hi what is actually simple-client-critical simple-client-medium   I   I  want to change the default action from alert to block . the rule is under simple-client-medium , but the search result shows it is under simple-client-high Thanks       ... View more

Hi, I have created tap zone and created policy under security policies . In my ddos profile there are two policies one for trust zone another one for untrust zone if I create another policy for tapzone , is it a good creating another ddos policies for tap zone   if yes how can i do that ? Thanks     ... View more