NetScaler

Configure rate limit at packet level

September 21, 2020

Contributed by:

S S

Note: This feature was introduced in NetScaler release 11.1 build 51.21.

You can collect statistics at the packet level to determine bad/attack prone packets flowing through all the connections identified by the selector. At any point, if the percentage of bad or attack-prone packets exceed the configured threshold, a corrective action (RESET or DROP) is triggered as per the configuration. This functionality can be used to address DDoS attacks involving small TCP packets in which PUSH flag is enabled.

The following configuration demonstrates this functionality. This configuration tracks packet credits for all the TCP connections flowing through the system. This creates a session and associates on pcb/natpcb and the performs the per packet check.

Example:

add stream selector packetcreditrateselector client.ip.src client.tcp.srcport client.ip.dst client.tcp.dstport

add stream identifier packetcreditrateidentifier packetcreditrateselector –interval 1

add responder policy packetcreditratesessionpolicy "ANALYTICS.STREAM(\"packetcreditrateidentifier\").COLLECT_STATS(\"PACKET_CREDITS\", <max_threshold_percentage>, ACTION)" NOOP

<max_threshold_percentage> is any value between 0-100.
<!--NeedCopy-->

ACTION can be either DROP/RESET

After the configuration is complete, we must bind this responder policy globally.

Example:

bind responder global packetcreditratesessionpolicy 101 END -type REQ_DEFAULT

bind responder global packetcreditratesessionpolicy 102 END -type NAT_REQ_DEFAULT
<!--NeedCopy-->

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configure rate limit at packet level

September 21, 2020

Contributed by:

S S

September 21, 2020

Contributed by:

S S

Configure rate limit at packet level

In this article