Total Connection Protection

What Is Total Connection Protection?

Total Connection Protection limits the number of connections that all the sources open together. It is the connection counterpart of the total request block: a single counter is kept and the threshold is valid for the whole of the traffic.

The block is present on the vServices of both the HTTP and the L7 TCP type.

A Single Counter

All the Sources Together

Even if no address exceeds it on its own, the total number of connections is caught by the ceiling

5,000

Default Limit

The number of connections across the vService in a 10-second window

Silent Drop

Default Action

The only enforcement that is valid on both vService types is selected as the default

Silent Drop

The Hard Ceiling Enforcement

The action of the ceiling cannot be selected

Outside the Chain

The Availability Ceiling

The total hard ceiling is kept outside the first match wins chain

In Every Type

vService Type

HTTP and L7 TCP; on TCP the action set is limited to Silent Drop

The Total Connection Protection Card on L7 DDoS Protection

The block in the body of the L7 DDoS Protection card reduces its setting to a single sentence: if traffic from all IPs combined exceeds <limit> connections in <window>, <action>. The limit value is written in bold, the time window faded, and the action in its own color. If a hard ceiling is defined, a second tier is added to the end of the sentence with a semicolon.

When the pencil icon at the top right of the card is clicked, the edit screen opens.

L7 DDoS Protection - The Total Connection Protection Card

The Total Connection Protection Edit Screen

1. The Bot/DDoS Management tab is opened.
2. The pencil icon at the top right of the Total Connection Protection block in the body of the L7 DDoS Protection card is clicked; the edit window titled Edit - Total Connection Protection opens.
3. The following fields are edited and confirmed with the Edit button.

The Total Connection Protection Edit Screen

INFO

Total Connection Protection Default: On

It determines whether the block is on or not; its default value is on and this value is written to the configuration record created when the protection is enabled. While it is on, the block makes measurements and produces events even while the protection is in the Monitor mode; for it to be off, the switch must be turned off manually.

When it is turned off, all the other fields in the form (the time window, the limit, the action and the hard ceiling if there is one) are hidden.

When it is turned off, the block card does not leave the screen: it fades and the Disabled badge appears on it, and the values written continue to be read.

INFO

Time Window Default: 10 seconds

For how long the counter will be accumulated is defined. The value is entered with a number and unit pair; seconds, minutes or hours can be selected as the unit. Its default value is 10 seconds; at least 1 second and at most 1 hour can be defined.

The window is repeated in the suffix on the right of the limit field as well: with a label such as / 10s the field shows to which period the limit belongs.

INFO

Connection Limit Default: 5000

How many connections all the sources can produce together within the window is defined; its default value is 5000. Only an integer, at least 1, can be entered in the field. When the counter exceeds this value, the block is triggered.

INFO

Limit Action Default: Silent Drop

The enforcement to be applied when the limit is exceeded is selected; its default value is Silent Drop.

Option	What it does
Silent Drop	The request is left unanswered, the connection is silently dropped.
Block	It is blocked with the defined status code.
Redirect	It is redirected to the defined address.
Show Content	A page from the selected content profile and a status code are returned.
Show Captcha	The source is directed to the shared challenge.

The action set of the total blocks is narrower: Tarpit and Quarantine are not present here, because a total limit covers not a single source but the whole of the traffic.

On L7 TCP vServices this set is limited to Silent Drop: the blocking page, the redirection and the challenge are responses specific to HTTP.

According to the selected action, additional fields appear in the form: Block status code (default 403) for Block, Redirect location (default /robots.txt) and Redirect code (default 302) for Redirect, and Content page and Status code (default 403) for Show Content. Show Captcha does not carry an additional field in this form: the appearance of the challenge is managed from the Captcha card.

INFO

Hard Ceiling (Silent Drop) Default: Undefined

It is the second and harder tier; it is not defined by default. When it is turned on, the field is filled with twice the default limit of the block (10000); the current value written in the limit field does not change this pre-filling, and the value needed is written manually. The enforcement of the ceiling cannot be selected: in this block it is always Silent Drop and this name is written in the label of the field as well.

While the ceiling is on, Limit Action works only in the region between the limit and the ceiling; when the counter exceeds the ceiling, the decision passes to the enforcement of the ceiling. This two-tier distinction is set up only in the Active mode: in the Monitor mode the ceiling does not work as a separate tier. This second tier is added to the card sentence with a semicolon: …; over <ceiling> connections, <action>.

INFO

Edit

Changes in the form are saved by clicking the Edit button. There is no additional confirmation window or deploy step; the Load Balancer configuration is regenerated and applied automatically. The operation is written to the user log with a change summary.

The sentence below the form is live

The information box below the fields builds the sentence that will appear on the card while it is being written: as the limit, the window and the action change, the sentence is updated instantly. Before saving, how the setting will be read on the screen is seen from here.

The total hard ceiling is an availability ceiling

Unlike the source-based ceilings, the total hard ceiling is kept outside the first match wins chain: even if a block further above has already decided the request, the ceiling comes into play.

The trust in the verified bots does not cover this block

The Trust Verified Bots setting of the card affects only the source-based blocks; the total limits are not affected by this setting.

Scope and Limits

INFO

• It is present on both vService types. On L7 TCP the action set is limited to Silent Drop.
• A single counter is kept. The threshold is valid not per source but for the whole of the traffic.
• The block is on by default. When the configuration is saved, the switch is written as on; turning it off is the decision of the operator.
• The enforcement is applied only in the Active mode. While L7 DDoS Protection is in the Monitor mode, the counters work, events are produced and the card sentence is read; however no request is stopped.
• The first match wins. If a request has been decided in a block further above, this block does not produce an enforcement for that request.
• The pencil icon depends on the permission. The block card is displayed with read-only permission; the pencil icon that opens the edit window is displayed only on the users that have edit permission.
• The enforcement of the hard ceiling is fixed. When the ceiling is exceeded, the traffic is always dropped silently; the action cannot be selected.