Radware Alteon Application Manual page 615

Example 2: A Rate Limiting Filter Based on Source IP Address
This example illustrates how to define a filter that limits clients with IP address 30.30.30.x to a
maximum of 150 TCP connections or 150 UDP or ICMP packets per second.
1. Configure the filter as follows.
>> # /cfg/slb/filt 100/ena
>> Filter 100 # sip 30.30.30.0
>> Filter 100 # smask 255.255.255.0
>> Filter 100 # proto <any|<number>|<name>>
>> Filter 100 # adv/security/ratelim
>> Rate Limiting # ena
>> Rate Limiting # maxconn 15
>> Rate Limiting # timewin 1
>> Rate Limiting # holddur 10
— Time window = 1 second
— Hold duration = 10 minutes
— Max rate
= maxconn/timewin =
2. Apply and save the configuration.
Any client with source IP address equal to 30.30.30.x is allowed to make 150 new TCP
connections (or UDP/ICMP packets) per second to any single destination. When the rate limit of
150 is met, the hold duration takes effect. The client is not allowed to transmit sessions or
connections to the same destination for 10 minutes.
Example 3: A Rate Limiting Filter Based on Virtual Server IP Address
This example defines a filter that limits clients to 100 TCP connections per second or 100 UDP or
ICMP sessions per second to a specific destination (VIP 10.10.10.100). Once a client exceeds
that limit, the client is not allowed to initiate new TCP connection requests or send UDP or ICMP
traffic to that destination for 40 minutes.
Figure 99 - Limiting User Service to a Server, page 616
limit client access to a specific destination:
Document ID: RDWR-ALOS-V2900_AG1302
Alteon Application Switch Operating System Application Guide
Advanced Denial of Service Protection
(Enable the filter)
(Specify the source IP address)
(Specify the source IP address mask)
(Specify TCP, UDP or ICMP protocol)
(Select the Rate Limiting Advanced
menu)
(Enable rate limiting on TCP)
(Specify the maximum connections
in multiples of 10)
(Set the time window in seconds)
(Set the hold duration in minutes)
150 connections/1 second = 150 connections/second
illustrates how to use this feature to
615