Bug ID 497681: Tuning of Application DoS URL qualification criteria

Last Modified: Apr 28, 2025

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4

Fixed In:
12.0.0, 11.6.0 HF5, 11.5.3

Opened: Dec 19, 2014

Severity: 3-Major

Symptoms

Application DoS can not be tuned in order to tell which transactions are qualified for client side mitigation.

Impact

URL will be detected as non-qualified. AVR does not qualify URLs according to the system's qualification criteria.

Conditions

This occurs in response to the following scenario: 1. Create new L7-DoS profile, enable CS injection prevention. 2. Send more than 10 requests to a qualified URL. Make sure that URL is detected as qualified. 3. Send 1 request with HEAD or TRACE methods.

Workaround

None.

Fix Information

This release provides tuning for the Application DoS URL qualification criteria.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips