Radware DefensePro 6.02, User Manual

Page: 186 / 339

DefensePro User Guide
Security Configuration
186
Document ID: RDWR-DP-V0602_UG1201
Activation Threshold The minimum number of queries per second—after the specified
Activation Period—on a single connection that causes the device to
consider there to be an attack. When the device detects an attack, it
issues an appropriate alert and drops the DNS packets that exceed the
threshold. Packets that do not exceed the threshold bypass the
DefensePro device.
Values: 0–4,000,000
Default: 0
Activation Period The number of consecutive seconds that the DNS traffic on a single
connection exceeds the Activation Threshold that causes the device to
consider there to be an attack.
Values: 0–30
Default: 3
Termination Threshold The maximum number of queries per second—after the specified
Termination Period—on a single connection that cause the device to
consider the attack to have ended.
Values: 0–4,000,000
Default: 0
Note: The Termination Threshold must be less than or equal to the
Activation Threshold.
Termination Period The time, in seconds, that the DNS traffic on a single connection is
continuously below the Termination Threshold, which causes the device to
consider the attack to have ended.
Values: 0–30
Default: 3
Max QPS The maximum allowed rate of DNS queries per second.
Values: 0–4,000,000
Default: 0
Escalation Period The time, in seconds, that the device waits before escalating to the next
specified Mitigation Action
Values: 0–30
Default: 3
Advanced Report Settings
Packet Report Specifies whether the device sends sampled attack packets to APSolute
Vision for offline analysis.
Default: Disabled
Note: When this feature is enabled, for the feature to take effect, the
global setting must be enabled (Configuration perspective >
Advanced Parameters > Security Reporting Settings >
Enable Packet Reporting).
Table 97: DNS Protection Profile Parameters
Parameter Description