Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Blason_R
Leader
Leader

fw samp pkt-rate rule per host

Hi Team,


I am seeing huge surge in UDP/53 traffic and upon investigation found that lot of rogue traffic is seen for port 53 since my customer has hosted his NS server behind firewall.

However a temporary remedy I consolidated the hosts and dropped them through fw samp using ASN/CC/source/cidr

But this is all manual; wondering if any script or option so that I can define 

if pkt-rate/second per host is above 1000 add that in fw samp rule base

I guess directly adding below rule would block genuine traffic as well where pkt-rate accepts the result cumulatively

fw samp add -a d -t 3200 -c "UDP_Flood" quota service 53 source any destination <NS_SERVER> pkt-rate 1000 flush true

 

Edit: I guess I overlooked the document and that can be achieved using track option.

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
0 Kudos
0 Replies

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events