Smarter by Design.Simpler for Business
Packet Integrity
What Is Packet Integrity?
Packet Integrity checks the consistency of the packet itself and does not look at the rate at all. The band is on the L4 DDoS Management screen and its explanation note gives its scope in a single line: Protocol-violating, fragmented or spoofed packets.
The other bands look at the rules of a protocol itself: how many connections were opened, how many packets came per second. This band, on the other hand, asks whether the packet is credible. Does a packet have an open session, can the source address it carries really be that address, is it dictating the path it will follow itself. The answers to these questions are given without looking at the rate; even a single packet is caught if it violates the rule.
The four rules of the band are gathered in a single box.
| Box | What it looks at |
|---|---|
| Malformed Packets | The packets that have no open session, the packets that take on the device's own address, the packets that claim to come from the private address ranges and the packets that try to determine their path themselves. |
4
Rules
All of them in a single box: Malformed Packets
None
Adjustable Limit
There is no threshold or limit field in any rule
2
Able to Send to Quarantine
The sessionless packet and the taking on of its own address rules
1
Exempt from the Promotion Permission
The rule of the packets that take on its own address; it can promote while the permission is off as well
3
Carrying a Learning Lock
There is no switch in the source routing setting, which produces no measurement
Enforcing 3
In an Untouched Table
Three rules are born in enforcement and one rule in monitoring
The band has no setting of its own
The band and the box carry no editing element: neither a mode selector nor a pencil icon is found. Every rule is adjusted with the pencil in its own row, in its own edit window.
The Packet Integrity Band on L4 DDoS Management
The band is located below the protocol bands. In the header there are the name of the band, the number of rules it carries in parentheses and below it the explanation note; at the top right there are the mode distribution badges.
L4 DDoS Management - The Packet Integrity Band
| Element | Meaning |
|---|---|
| The title and the number | The name of the band and the number of rules in it: Packet Integrity (4). This number is fixed; the band carries the same four rules in every route table. |
| The explanation note | The fixed text that summarizes the scope of the band. |
| The distribution badges | The mode distribution of the four rules of the band: Enforcing, Monitoring and Off. A badge whose number is zero is not displayed. |
| The single box | In the header of the box there are its name and the number of rules it carries; the number of the band and of the box is the same in this band. |
The number on the band and the number on the status card do not count the same set
The badges of the band count all four rules. The status card, on the other hand, takes into the jury only the rules that use the enforcement levels; the source routing setting of the band, which has an on/off structure, does not enter the column of the card at all.
For this reason, while the band counts four rules, the card counts only three rules from this band.
Rule Modes
The four rules in the band use three separate value sets.
| Rule class | The values offered | How many rules |
|---|---|---|
| The ones that use the enforcement levels | Disabled · Monitor · Block · Quarantine | 2 |
| The enforcement rule without quarantine | Disabled · Monitor · Block | 1 |
| The on/off setting | Enabled · Disabled | 1 |
The color of the row is the color of the mode
At the beginning of every rule row there is a status dot and its color shows the mode of the rule:
| Mode | Dot |
|---|---|
| Block and Quarantine | Green |
| Monitor | Amber |
| Disabled | Dim gray |
| Enabled in an on/off setting | Green |
In the sentence of the rules that use the enforcement levels the action word is colored separately: amber in the monitoring mode, red in the enforcement mode. In the on/off setting, on the other hand, there is no highlight in the Enabled value, and in the Disabled value the whole of the sentence is displayed amber.
The catalog defaults are in force from day one
The defaults defined in the catalog are written to the table while the route table is being created and in the configuration check at device startup. For this reason, in a route table that has never been touched, all four rules of the band are in a mode: the sessionless packet and the taking on of its own address rules are born Block, the source routing setting Enabled and the private address range rule Monitor. The band reads Enforcing 3 · Monitoring 1.
The way to return all the rules to the catalog defaults at once is the returning to the default operation on the Learning strip.
Badges on the Row
At the right end of the rule row, where the sentence ends, there are small indicators. Their order from left to right is fixed: padlock → pencil → verdict badge.
| Indicator | What it is | When it is seen |
|---|---|---|
| Padlock | A lock icon without a word, on its own. It is the operator's Learning Lock switch. | While the learning lock of the rule is on. |
| Pencil | It opens the edit window of the rule. | While there is change authorization. |
| Verdict badge | A clickable badge carrying an icon and a word. It is the verdict of the learning engine about this rule in the last round. | If the engine has run at least one round. |
The verdict badge shows one of four words: Suggestion (there is a recommendation waiting to be applied), Locked (the engine has a change but it cannot be applied), Learning (there is no word to say yet) and Verified (the current setting was found in place).
There is neither a badge nor a padlock in the source routing setting
Three of the four rules of the band produce measurements and are in the field of view of the learning engine. The source routing setting, on the other hand, produces no measurement; for this reason there is no Learning Lock switch in its edit window and no verdict badge in its row.
This is its only structural difference from the other three rules of the band.
Edit Window
The pencil that comes right after the sentence in every row opens the rule's own edit window. The title of the window is in the form Rule settings · <rule name>.
| Element | When it is found |
|---|---|
| The information band | In every rule. It shows the catalog definition of the rule. |
Status | In every rule. The option set changes according to the type of the rule. |
Learning Lock | In the three rules that produce measurements. It is not found in the source routing setting. |
| Sub-fields | Not found in any rule in this band; the rules have no adjustable value. |
Save | In every rule. It is inactive while there is a validation error. |
The saving updates only the changed fields and takes effect immediately. If no field has changed, the request is not sent.
Rules in the Box
Scope and Limits
INFO
- The band is displayed with the same four rules in every route table and carries a single box.
- There is no adjustable threshold in any rule. The decision is made by looking at the packet itself.
- The rules cover both the traffic directed at the device and the traffic passed through the device.
- In an untouched route table three rules are born in enforcement and one rule in monitoring.
- Only two rules can send a source to quarantine. In the private address range rule the quarantine option is not offered at all.
- The source routing setting produces no measurement, it has no panel on the dashboard and it is not in the field of view of the learning engine.
- The measurements do not separate the IP versions; the only exception is the private address range rule, it works only on the IPv4 traffic.
- The sources in the exemption list are not caught by the three rules that produce measurements and are not written to their measurements either; the source routing setting does not recognize the exemption list.
- Editing requires modify permission in the Network area. With a monitoring-only authorization the band and the sentences are displayed, the pencil icons are not displayed.
