Nortel 5100 User Manual page 43

• LockoutAudit Duration: the interval (in seconds) of the mark and sweep audit
used to clear the lockout condition
— range: from 1 to MAXINT
— default: 60 seconds
• MaxNumLockouts: the maximum number of source IP addresses that can be
locked out at a given time
— range: 1 - 10 000
— default: 10 000
• AlarmThresholds: the thresholds for the distributed DoS alarms, indicating
the number of locked-out endpoints
— minor alarm (first value) default: 10%
— major alarm (second value) default: 50%
— critical alarm (third value) default: 100%
• MaxAttemptsPerInterval: the number of new HTTP transactions per sample
interval calculated
— range: from 1 to MAXINT
— default: 6
— threshold rate = MaxAttemptsPerInterval/SampleInterval
• SampleInterval: the sample interval (in seconds) used in the transaction rate
calculation
— range: from 1 to MAXINT
— default: 2 seconds
• BucketCapacityFactor: used to determine the size of the token bucket
(BucketCapacityFactor * MaxAttemptsPerInterval = bucket size)
— range: from 1 to MAXINT
— default: 165
Increase this value to accommodate occasional spikes above the allowed
sustained rate.
• MaxNumSuspects: the maximum number of source IP addresses that can be
monitored at any given time
— range: from 1 to MAXINT
— default: 1000
Provisioning Client User Guide
43