Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Dec 21, 2012

iRule or Custom Attack Signature??

I am wanting to configure something to looks for the following patterns that pertain to recent DDoS attackes that have been going around and log the event.     · UDP packets containing this...
app sec
BIG-IP Access Policy Manager (APM)
security
Ido_Breger_3805's avatar
Ido_Breger_3805
Historic F5 Account
Dec 23, 2012
Hi Mike,

 

ASM signatures can detect that within HTTP requests, however, from what you describe (especially the need for UDP), it seems that this isn't part of HTTP.

 

The general advice is to use ASM for anything that is HTTP related (ASM sigs are faster than iRules) and iRules for anything else.