Configure denial-of-service filter settings

Overview

A denial-of-service (DoS) attack disrupts access to a host, typically by flooding it with requests. To prevent interruptions to your Code42 environment, the Code42 server uses a denial-of-service filter (DoSFilter) to stop requests that exceed a defined threshold. When the Code42 server detects a DoS attack, the filter:

• Delays processing of requests
• Logs excessive request activity

This article describes the various Code42 DoSFilter properties and provides instructions for administrators to change the default values.

Denial-of-service filter (DoSFilter)

A high number of requests in a brief time span can originate either from a malicious denial-of-service attack, or from a valid, yet problematic device within your Code42 environment. The Code42 server DoSFilter tracks the number of requests from each source. It identifies sources as authenticated users, or by IP address or session ID.

The DoSFilter keeps track of the number of requests from a source per second. By default, the filter delays requests that exceed the limit of 40 per second and modifies the response headers to indicate the delayed responses. The filter gives first priority to authenticated users, then to connections identified by IP addresses. Unidentified connections have the lowest priority.

When the rate limit is exceeded, the filter writes a WARN level log message to the com_backup42_app.log server log file found in your server log directory. The WARN level log messages are labeled DOS ALERT and display one of the following formats:

DOS ALERT: Request delayed={}ms, ip={}, session={}, user={}
DOS ALERT: Request throttled ip={}, session={}, user={}
DOS ALERT: Request rejected ip={}, session={}, user={}
DOS ALERT: Request timed out uri={}, timeout={}, ip={}, session={}, user={}

The DoSFilter provides a set of properties that you can use to tune the filter. The c42.http.dosfilter.maxRequestsPerSec property sets the maximum rate of requests per second from the same source. The default value is 40. Once that rate limit is exceeded, DOS ALERT messages are logged and requests are throttled. By default, subsequent requests from the same source are each delayed by at least 100 milliseconds (per the c42.http.dosfilter.delayMs property) and sent to the back of the priority queue, while other requests are serviced first.

You can tune these and other Code42 DoSFilter properties to change the response to high request rates.

Configure DoSFilter properties

From the Code42 administration console command line interface, use the prop.set command to configure DoSFilter properties:

1. Sign in to the administration console.
2. Double-click the logo in the upper-left corner of the administration console.
   The command-line interface appears.
3. Enter theprop.setcommand followed by the property name and value in this format (see below for complete list of available properties):

prop.set c42.http.dosfilter.<propertyName> <value> save all

Replace <propertyName> with the name of the DoSFilter property, and replace <value> with the value to set for that property.

4. To verify a setting's value, enter the prop.show command:

prop.show c42.http.dosfilter.<propertyName>

The current value for the setting is displayed.

Code42 DoSFilter properties

To tune the DoSFilter implementation, you can configure the following Code42 properties with the Code42 prop.set command.

External resources

• Denial-of-service attack (Wikipedia)

Related topics

• Security settings reference
• Configure the CORS domain whitelist for web applications
• Disable older protocols and cipher suites
• Disable data key sharing