> For the complete documentation index, see [llms.txt](https://docs.nokron.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nokron.net/waf-f5/big-ip-application-security-manager/l7-ddos-attack-protection-configuration.md).

# L7 DDoS Attack Protection Configuration

The **L7 DDoS Protection** feature in F5 ASM/AWAF is designed to mitigate **Layer 7 Distributed Denial of Service (DDoS)** attacks, which target the application layer by overloading the web application with requests that appear legitimate. The configuration screen for L7 DDoS protection is divided into five main sections, with criteria based on different methods for detection and response.

***

#### **1. Detection Criteria:**

The **Detection Criteria** section helps define how the system identifies potential DDoS attacks, specifically focusing on **latency** and **transactions per second (TPS)**.

* **Latency + TPS**:
  * This method combines latency with **transactions per second** (TPS) to detect unusual traffic patterns.
* **Stress-based Detection**:
  * This approach detects stress on the application servers, which could indicate the server is being overwhelmed by traffic typical of a DDoS attack.
* **Auto-calculated (F5 Proprietary)**:
  * F5's proprietary algorithm automatically calculates the thresholds for DDoS detection, ensuring real-time adjustments based on observed traffic patterns.
* **Server-side Detection**:
  * This focuses on server-side metrics to determine whether the server is under stress or if the traffic rate exceeds the normal threshold.
* **Smaller Values**:
  * For the **Stress-based Detection** mechanism, the threshold values for detection should be **smaller** than the corresponding vectors used in **TPS-based Detection**. This ensures that stress-based triggers occur before TPS-based detection, allowing for early mitigation.

***

#### **2. Suspicious Criteria:**

The **Suspicious Criteria** focuses on TPS-based detection, which looks for spikes in traffic that could indicate an ongoing attack.

* **TPS-based Detection**:
  * This detection is primarily based on **transactions per second (TPS)**, which measures the rate of requests sent to the web server. A high TPS rate could suggest a potential DDoS attack.
* **Client-side Detection**:
  * This method analyzes the traffic from the client-side (e.g., IP address, cookies) to detect abnormal behavior or attack patterns.
* **Greater Values**:
  * The **TPS-based detection** criteria should have **higher values** than those of **Stress-based detection** to ensure that TPS thresholds trigger only when significant traffic patterns are detected.

***

#### **3. Anomaly Engine Interval Values:**

The **Anomaly Engine** is responsible for analyzing traffic patterns over a period of time to determine if a request is legitimate or part of a potential attack. The interval settings for this engine are critical in setting how often traffic is analyzed and anomalies are detected.

* **Interval settings**:
  * These settings control how frequently the **Anomaly Engine** checks for anomalies in the traffic. The **interval** values help balance **real-time monitoring** with system performance and resource consumption.
* **Important Consideration**:
  * The **interval values** should be carefully configured to ensure that legitimate traffic is not mistakenly flagged while also ensuring that the system can respond to DDoS attacks quickly. F5 generally uses **smaller intervals** for more frequent checks, providing faster detection of suspicious traffic spikes.

***

#### **Key Recommendations for Configuration**:

1. **Fine-tuning Detection Criteria**:
   * Adjust the **latency** and **TPS-based** thresholds based on historical traffic patterns to avoid false positives and ensure timely DDoS detection.
2. **Set Realistic Interval Values**:
   * The **interval values** for anomaly detection should strike a balance between **detection speed** and **system performance**. Avoid too short an interval that could overload the system with excessive checks, but ensure it is short enough to detect attacks in a timely manner.
3. **Monitor Client-Side and Server-Side Metrics**:
   * Use both **client-side** and **server-side** metrics to ensure comprehensive monitoring. **Server-side** metrics help detect stress on the web application, while **client-side** metrics are useful for identifying sources of suspicious traffic.
4. **Stress-based Detection**:
   * Keep the **stress-based detection values smaller** than **TPS values** to ensure early intervention before a traffic spike overwhelms the server.
5. **Regularly Review and Adjust Criteria**:
   * Regularly review and adjust the detection and suspicious traffic thresholds as your application traffic patterns evolve, ensuring continued DDoS protection efficacy.