Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP AFM
Known Affected Versions:
11.4.1
Opened: Sep 19, 2013 Severity: 2-Critical
On HSBe2 based platforms, the default threshold does not provide best performance under IP fragment flood attack.
Slow performance.
This occurs on HSBe2 based platforms including B4300 and B2100 blades
Change the default threshold setting for the ip fragment vector to the following: ip-frag { default-internal-rate-limit 10000 detection-threshold-percent 500 detection-threshold-pps 1000 } ip-frag-flood { default-internal-rate-limit 10000 detection-threshold-percent 500 detection-threshold-pps 1000 }
None