Symptoms

An expected brute force attack does not start although the traffic pattern from an IP or to URL seems to be matching the configuration to start an attack.

Impact

A brute force attack is not detected and not prevented.

Conditions

Brute force attack is configured. Failed logins are happening that matches the configuration. The entity (IP/URL) is generating traffic less than 2 minutes.

Workaround

None

Fix Information

Brute force attacks on entities that generate traffic for less than 5 minutes detected and mitigated.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips