Bug ID 497681: Tuning of Application DoS URL qualification criteria

Last Modified: Oct 06, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP ASM(all modules)

Known Affected Versions:
11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.10, 11.5.2, 11.5.2 HF1, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4

Fixed In:
12.0.0, 11.6.0 HF5, 11.5.3

Opened: Dec 19, 2014
Severity: 3-Major


Application DoS can not be tuned in order to tell which transactions are qualified for client side mitigation.


URL will be detected as non-qualified. AVR does not qualify URLs according to the system's qualification criteria.


This occurs in response to the following scenario: 1. Create new L7-DoS profile, enable CS injection prevention. 2. Send more than 10 requests to a qualified URL. Make sure that URL is detected as qualified. 3. Send 1 request with HEAD or TRACE methods.



Fix Information

This release provides tuning for the Application DoS URL qualification criteria.

Behavior Change