Bug ID 1969945: Stats_rate changes along with Detection Threshold for NXDOMAIN DoS vector

Last Modified: Jul 02, 2025

Affected Product(s):
BIG-IP AFM(all modules)

Known Affected Versions:
17.1.2.1, 17.1.2.2

Opened: Jun 20, 2025

Severity: 3-Major

Symptoms

Lowering the threshold reduces the stats_rate, and increasing the threshold increases the stats_rate.

Impact

Inaccurate stats_rate values for the NXDOMAIN Query vector

Conditions

The detection threshold for the NXDOMAIN Query vector is modified (e.g., from 2000 to 200 or vice versa). Constant DNS traffic is being generated and sent to the BIG-IP device (e.g., using dnsperf)

Workaround

None

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips