Active Source-IP Protection

What Is Active Source-IP Protection?

Active Source-IP Protection measures not the volume of the traffic but its width: it counts how many different source addresses produce traffic in a fixed measurement window. While all the other blocks ask the question "how much", this block asks the question "from how many places".

The distinction is important in practice: in a distributed attack in which every participant sends few requests one by one, neither the source-based limits nor the total limits may be triggered; however, the number of addresses that produce traffic at the same time rises unusually. This block catches exactly that situation.

The block is present on the vServices of both the HTTP and the L7 TCP type.

Width

Not Volume

Not how many requests have come but how many different addresses have produced traffic is counted

10,000

Default Limit

The number of different source addresses allowed in the measurement window

10 Seconds

Fixed Measurement Window

It cannot be adjusted; the period is written in the label of the limit field

Silent Drop

Default Action

The only enforcement that is valid on both vService types is selected as the default

No Hard Ceiling

A Single Tier

The decision is given with a single threshold

In Every Type

vService Type

HTTP and L7 TCP; on TCP the action set is limited to Silent Drop

The Active Source-IP Protection Card on L7 DDoS Protection

The block in the body of the L7 DDoS Protection card reduces its setting to a single sentence: if more than <limit> distinct IPs send traffic in <window>, <action>. Unlike the sentence of the other blocks, a source scope is not written here; what is counted is not the request itself but the number of the addresses that produce traffic.

When the pencil icon at the top right of the card is clicked, the edit screen opens.

L7 DDoS Protection - The Active Source-IP Protection Card

The Active Source-IP Protection Edit Screen

1. The Bot/DDoS Management tab is opened.
2. The pencil icon at the top right of the Active Source-IP Protection block in the body of the L7 DDoS Protection card is clicked; the edit window titled Edit - Active Source-IP Protection opens.
3. The following fields are edited and confirmed with the Edit button.

The Active Source-IP Protection Edit Screen

INFO

Active Source-IP Protection Default: On

It determines whether the block is on or not; its default value is on and this value is written to the configuration record created when the protection is enabled. While it is on, the block makes measurements and produces events even while the protection is in the Monitor mode; for it to be off, the switch must be turned off manually.

When it is turned off, all the other fields in the form (the limit, the action and the additional fields bound to the action) and the information sentence below are hidden.

When it is turned off, the block card does not leave the screen: it fades and the Disabled badge appears on it, and the values written continue to be read.

INFO

Active Source-IP Limit (10s) Default: 10,000

How many different source addresses can produce traffic in the measurement window is defined; its default value is 10,000. Only an integer, at least 1, can be entered in the field. When the number exceeds this value, the block is triggered.

The period inside the label is the measurement window and cannot be changed: there is no separate time window field in this block. The period comes from the lifetime of the source tracking table and uses the same horizon as the number of active addresses on the dashboards.

INFO

Limit Action Default: Silent Drop

The enforcement to be applied when the limit is exceeded is selected; its default value is Silent Drop.

Option	What it does
Silent Drop	The request is left unanswered, the connection is silently dropped.
Block	It is blocked with the defined status code.
Redirect	It is redirected to the defined address.
Show Content	A page from the selected content profile and a status code are returned.
Show Captcha	The source is directed to the shared challenge.

This block uses the same scope-wide action set as the total blocks: Tarpit and Quarantine are not present here, because the decision is applied not to a single source but to the whole of the traffic.

On L7 TCP vServices this set is limited to Silent Drop: the blocking page, the redirection and the challenge are responses specific to HTTP.

According to the selected action, additional fields appear in the form: Block status code (default 403) for Block, Redirect location (default /robots.txt) and Redirect code (default 302) for Redirect, and Content page and Status code (default 403) for Show Content. Show Captcha does not carry an additional field in this form: the appearance of the challenge is managed from the Captcha card.

INFO

Edit

Changes in the form are saved by clicking the Edit button. There is no additional confirmation window or deploy step; the Load Balancer configuration is regenerated and applied automatically. The operation is written to the user log with a change summary.

The sentence below the form is live

The information box below the fields builds the sentence that will appear on the card while it is being written: as the limit and the action change, the sentence is updated instantly. The period in the sentence is fixed and does not change. Before saving, how the setting will be read on the screen is seen from here.

There is no time window and no hard ceiling in this block

Unlike the other blocks, there is neither an adjustable time window nor a second tier here. The measurement window is fixed and is written in the label of the limit field; the decision is given with a single threshold.

The trust in the verified bots does not cover this block

The Trust Verified Bots setting of the card affects only the source-based blocks; the number of active sources is not affected by this setting.

Scope and Limits

INFO

• It is present on both vService types. On L7 TCP the action set is limited to Silent Drop.
• The time window cannot be adjusted. The measurement window is fixed and is shown in the label of the limit field.
• There is no hard ceiling. The block has a single tier.
• Not the volume but the width is measured. When the number of addresses exceeds the threshold, the block is triggered whatever the number of requests that those addresses produce is. As long as the threshold stays exceeded, the enforcement is applied not only to the new addresses but to every request that comes.
• The block is on by default. When the configuration is saved, the switch is written as on; turning it off is the decision of the operator.
• The enforcement is applied only in the Active mode. While L7 DDoS Protection is in the Monitor mode, the counters work, events are produced and the card sentence is read; however no request is stopped.
• The first match wins. If a request has been decided in a block further above, this block does not produce an enforcement for that request.
• The pencil icon depends on the permission. The block card is displayed with read-only permission; the pencil icon that opens the edit window is displayed only on the users that have edit permission.