Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
Document ID: RDWR-ALOS-V2900_AG1302
613
UDP and ICMP Rate Limiting
Alteon filters can be configured to perform rate limiting on UDP and ICMP traffic. Because UDP and
ICMP are stateless protocols, the maximum threshold (the
maxcon
command) should be interpreted
as the maximum number of packets received from a particular client IP address.
When the maximum threshold has been reached before the time window has expired, all packets of
the configured protocol are dropped until the configured holddown (
holddur
) period has expired.
TCP Rate Limiting
Alteon monitors new TCP connections by looking for incoming SYN packets that match a specified
TCP rate filter. The first SYN packet to match the filter creates a TCP rate session in the session
table. Subsequent SYN packets from the same client that match the same filter increment the TCP
rate session counter. If the counter reaches the threshold value before the TCP rate session ages
out, then a holddown period is reached. During the holddown period, no new TCP sessions from this
client that match this filter are allowed. After the holddown period ends, the next SYN packet is
allowed, and a new TCP rate session is created.
Figure 98 - Configuring Clients with Different Rates, page 613
shows four clients configured for TCP
rate limits based on source IP address. Clients 1 and 4 have the same TCP rate limit of 10
connections per second. Client 2 has a TCP rate limit of 20 connections per second. Client 3 has a
TCP rate limit of 30 connections per second.
When the rate of new TCP connections from clients 1, 2, 3, and 4 reach the configured threshold,
any new connection request from the client is blocked for a pre-determined amount of time. If the
client's IP address and the configured filter do not match, then the default filter is applied. The
default filter 2048 configured for Any is applied for all other connection requests.
Figure 98: Configuring Clients with Different Rates
