Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
Document ID: RDWR-ALOS-V2900_AG1302
615
Example
2: A Rate Limiting Filter Based on Source IP Address
This example illustrates how to define a filter that limits clients with IP address 30.30.30.x to a
maximum of 150 TCP connections or 150 UDP or ICMP packets per second.
1. Configure the filter as follows.
—
Time window = 1 second
—
Hold duration = 10 minutes
—
Max rate
= maxconn/timewin =
150 connections/1 second = 150 connections/second
2. Apply and save the configuration.
Any client with source IP address equal to 30.30.30.x is allowed to make 150 new TCP
connections (or UDP/ICMP packets) per second to any single destination. When the rate limit of
150 is met, the hold duration takes effect. The client is not allowed to transmit sessions or
connections to the same destination for 10 minutes.
Example
3: A Rate Limiting Filter Based on Virtual Server IP Address
This example defines a filter that limits clients to 100 TCP connections per second or 100 UDP or
ICMP sessions per second to a specific destination (VIP 10.10.10.100). Once a client exceeds
that limit, the client is not allowed to initiate new TCP connection requests or send UDP or ICMP
traffic to that destination for 40 minutes.
Figure 99 - Limiting User Service to a Server, page 616
illustrates how to use this feature to
limit client access to a specific destination:
>> # /cfg/slb/filt 100/ena
(Enable the filter)
>> Filter 100 # sip 30.30.30.0
(Specify the source IP address)
>> Filter 100 # smask 255.255.255.0
(Specify the source IP address mask)
>> Filter 100 # proto <any|<number>|<name>>
(Specify TCP, UDP or ICMP protocol)
>> Filter 100 # adv/security/ratelim
(Select the Rate Limiting Advanced
menu)
>> Rate Limiting # ena
(Enable rate limiting on TCP)
>> Rate Limiting # maxconn 15
(Specify the maximum connections
in multiples of 10)
>> Rate Limiting # timewin 1
(Set the time window in seconds)
>> Rate Limiting # holddur 10
(Set the hold duration in minutes)
