ADC

HTTP/2 DoS mitigation

November 11, 2023

Contributed by:

C S

The Http/2 Denial-of-Service (DoS) attacks no longer have any impact on a NetScaler appliance. If the appliance receives frames more than the maximum limit, the appliance silently closes the connection.

To mitigate attacks, HTTP profile enables you to change the default configuration of frames received in a HTTP/2 connection.

The HTTP/2 DoS mitigation table shows the list of HTTP/2 DoS attacks and its mitigation.

Configure the maximum limit for HTTP/2 frames to mitigate DoS attacks by using the command line interface

At the command prompt, type the following:

set ns httpprofile <profile_name> - http2MaxEmptyFramesPerMin <positive_integer> -http2MaxPingFramesPerMin <positive_integer> -http2MaxSettingsFramesPerMin <positive_integer> -http2MaxResetFramesPerMin <positive_integer> -http2MaxRxResetFramesPerMin <value>

Example:

set ns httpprofile profile1 -http2MaxEmptyFramesPerMin 20 -http2MaxPingFramesPerMin 20 -http2MaxSettingsFramesPerMin 20 -http2MaxResetFramesPerMin 20 -http2MaxRxResetFramesPerMin 100

Configure the maximum limit for frames received in a HTTP/2 connection by using the NetScaler GUI

Follow the steps given below to configure the maximum limit for frames received in a HTTP/2 connection:

On the navigation pane, expand System and then click Profiles.
On the Profile page, select the HTTP Profiles tab.
In the HTTP Profiles tab page, click Add.
In the Configure HTTP Profile page, set the following parameter.
1. http2MaxPingFramesPerMin. Set the maximum PING frames received per connection in a minute. If the number of PING frames exceed the configured limit, NetScaler silently drops packets on the connection.
2. http2MaxSettingsFramesPerMin. Set the maximum SETTINGS frames received per connection in a minute. If the number of SETTINGS frames exceed the configured limit, NetScaler silently drops packets on the connection.
3. http2MaxResetFramesPerMin. Set the maximum RESET frames sent per connection in a minute. If the number of RESET frames exceed the configured limit, NetScaler silently drops packets on the connection.
4. http2MaxEmptyFramesPerMin. Set the maximum empty frames sent per connection in a minute. If the number of empty frames exceed the configured limit, NetScaler silently drops packets on the connection.
5. http2MaxRxResetFramesPerMin. Set the maximum RESET frames received per connection in a minute. If the number of RESET frames exceed the configured limit, NetScaler drops packets on the connection.
Click OK and Close.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

HTTP/2 DoS mitigation

November 11, 2023

Contributed by:

C S

November 11, 2023

Contributed by:

C S

HTTP/2 DoS mitigation

Configure the maximum limit for HTTP/2 frames to mitigate DoS attacks by using the command line interface

Configure the maximum limit for frames received in a HTTP/2 connection by using the NetScaler GUI

In this article