D-Link DFL-1660 User Manual page 519

10.3. Threshold Rules
Chapter 10. Traffic Management
rule, is added automatically to a Blacklist of IP addresses or networks. If several Protect actions
with blacklisting enabled are triggered at the same time, only the first triggered blacklisting action
will be executed by NetDefendOS.
A host based action with blacklisting enabled will blacklist a single host when triggered. A network
based action with blacklisting enabled will blacklist the source network associated with the rule. If
the Threshold Rule is linked to a service then it is possible to block only that service.
When blacklisting is selected, the administrator can choose to leave pre-existing connections from
the triggering source unaffected, or can alternatively choose to have the connections dropped by
NetDefendOS.
The length of time, in seconds, for which the source is blacklisted can also be set.
This feature is discussed further in Section 6.7, "Blacklisting Hosts and Networks".
519