Session Rate Limiting - Proxim Orinoco AP-2500 User Manual

Network Parameters

Session Rate Limiting

The Rate Limit tab allows you to configure Session Rate Limiting. Session Rate Limiting significantly reduces the risk
of Denial of Service attacks by allowing administrators to limit the number of DAT sessions any one user can take over
a given time period. If a user exceeds this limit, all subsequent traffic generated from that user is dropped until the
configured Time Interval is reached.
We also recommend enabling the Syslog feature. When a computer crosses the Session Rate Limit threshold, a
Syslog message is generated from the AP detailing the MAC address of the computer. Once the MAC address is
known, it can be blocked through the AP's MAC Address Filtering feature.
Follow these steps to configure Session Rate Limiting:
1. Click Configure > Security > Rate Limit.
2. Enable Session Rate Limiting by checking the Enable Session Limit box.
3. Configure the following limiting parameters:
• Session Limit Mean Rate: the default is 200 sessions per Session Time Limit Interval defined
• Session Limit Burst Size: the default is 400 sessions per Session Time Limit Interval defined
• Session Limit Time Interval: the default is 60 seconds
The Time interval is how much time the subscriber is given to consume TCP/IP sessions before a new allotment
occurs. The Burst Size is the maximum number of sessions allowed per the Time Interval. The Mean Rate is the
amount added to what is left after the Time Interval elapses (up to the number of sessions defined in the Burst
Size).
The Burst and Mean Rates can be significantly reduced (Mean Rate: 50, Burst Size: 100) to help mitigate the
consumption of TCP/IP sessions by a malicious user while allowing quicker access to the remaining users. We do
not recommend setting the Burst Size to below 100 and the Mean Rate to below 50 as these values could impact
normal user access.
Also, increasing the Time Interval to 120 or 180 would increase the number of sessions that would be cleaned up
before new sessions are allowed to be handed out to each subscriber. This may work better in larger deployments
that have many users.
Figure 4-22 Rate Limit Configuration Screen
99