config security dos tcp-slowdata-attack-protection
A Slow Data attack occurs when legitimate application-layer requests are made, but responses are read at an extremely slow rate. This technique aims to exhaust the target's connection pool by advertising a small value for the TCP Receive Window size while gradually emptying the client's TCP receive buffers. The result is an exceptionally low data transfer rate, effectively stalling communication.
The primary goal of this attack is to slowly consume system resources, such as memory and CPU, without triggering immediate detection. To mitigate this, connections can be disabled if probe packets fail to be sent within the configured zero-window timer.
Syntax
config security dos tcp-slowdata-attack-protection
edit <name>
set probe-interval-time <integer>
set probe-count <integer>
set action {pass|deny|block-period}
set block-period <integer>
set severity {high|medium|low}
set log {enable|disable}
set exception <datasource>
next
end
|
probe-interval-time |
Defines the interval time (in seconds) for the TCP zero window timer. After receiving a zero window packet, FortiADC periodically probes the peer side until it receives a non-zero window or the maximum probe count is reached. The default value is 30, with a valid range of 0 to 256 seconds. |
|
probe-count |
Specifies the maximum number of consecutive probes to be sent after receiving a zero window packet. Once this count is exceeded, the configured action will be triggered. The default value is 5, with a valid range of 0 to 256 probes. |
|
action |
Specifies the action taken when the probe count exceeds the limit and no response with a non-zero window is received. Options include:
The default value is deny. |
|
block-period |
The block-period option is available if action is block-period. Defines the duration (in seconds) for which new connections from the peer will be blocked if the Block-period action is selected. The default value is 60, with a valid range of 1 to 3600 seconds. |
|
severity |
Specifies the log severity level for zero-window probe events. Options include:
The default value is high. |
|
log |
Enables or disables logging of the zero-window probe events. The default value is disabled. |
|
exception |
Specify the DoS Exception configuration object. See config security dos exception. When FortiADC detects TCP sessions exhibiting slow data transfer behavior, it triggers the TCP Slow Data Flood Protection mechanism to prevent resource exhaustion. However, connections from source IPs listed in the exception rule are exempt from this detection and are allowed to proceed uninterrupted. |
Example
configure security dos tcp-slowdata-attack-protection
edit zero-window-limit
set probe-interval-time 30
set probe-count 5
set action block-period
set block-period 20
set log enable
set severity medium
set exception exception_1
next
end