Radware DefensePro 6.02, Руководство пользователя

Страница: 286 / 339

DefensePro User Guide
Real-Time Security Reporting
286
Document ID: RDWR-DP-V0602_UG1201
HTTP Flood Attack Details
Attack Info The information is displayed when the protection action is
blocking mode.
The attack information comprises the following parameters:
• Average Attack Rate—The average rate of spoofed SYNs and
data connection attempts per second, calculated every 10
seconds.
• Attack Threshold—The configured attack trigger threshold.
• Spoofed Sessions—The number of established, spoofed TCP
connections per second during the attack life cycle
(aggregated). These are the sessions that were established
through the SYN-cookies mechanism or were passed through
the SYN protection trusted list.
• Attack Duration—The duration, in
hh:mm:ss
format, of the
attack on the protected port.
• TCP Challenge
• HTTP Challenge
Authentication Lists Utilization The Authentication Lists Utilization group comprises the following
parameters:
• TCP Auth. List—The current utilization, in percent, of the TCP
Authentication table.
• HTTP Auth. List—The current utilization, in percent, of the
Table Authentication table.
Sampled Data Opens the Sampled Data dialog box, which contains a data on
sampled attack packets.
Parameter Description
Global
Attack Characteristics The attack characteristics comprise the following parameters:
• Source L4 Port
• Protocol
• Physical Port
• Packet Count
• VLAN
• MPLS RD
• Device IP
• Bandwidth [Kbits]
Note: Some fields can display multiple values, when relevant
and available. The values displayed depend on the
current stage of the attack. If a field is part of the
dynamic signature (that is, a specific value or values
appear in all the attack traffic), the Attack
Characteristics field displays the relevant value or
values.
Parameter Description