DoS / DDoS Global Parameters field descriptions

Last Updated : Oct 04, 2018 |
Prolog information
Metadata
Keywords:

Single Source DoS tab

Name
Description
SIP Method
The SIP method displayed on this page, which is the same as the services on the Domain DoS screen. For example, All, REGISTER, INVITE, SUBSCRIBE, PUBLISH, or OPTIONS.
Threshold (over 5 seconds)
The maximum number of sessions that can be started within 5 seconds.
Action
The action to be performed when any threshold is exceeded.
The options are:
  • Alert Only: An alert that displays the DoS incident but the call is not blocked.
  • Block: The call is blocked.
  • SIP Challenge: Authentication is initiated.
    Note:
    You must not select the SIP Challenge action for a DoS profile configuration. Avaya phones do not respond when they are authenticated by Avaya after being challenged by Avaya SBC.

Phone DoS/DDoS tab

Name
Description
SIP Service
The SIP service affected by the DoS attack. The options are:
  • TOTAL
  • Registrations
  • Calls
  • Presence Updates
  • Subscriptions
  • Misc
SIP Method
The SIP method displayed on this page, which is the same as the services on the Domain DoS screen. For example, All, REGISTER, INVITE, SUBSCRIBE, PUBLISH, or OPTIONS.
Threshold (over 3 seconds)
The maximum number of sessions that can be started within 3 seconds.
Action
The action to be performed when any threshold is exceeded.
The options are:
  • Alert Only: An alert that displays the DoS incident but the call is not blocked.
  • Block: The call is blocked.
  • Enforce Limits: The call is not blocked until the specified limit is reached.
  • SIP Challenge: Authentication is initiated.
    Note:
    You must not select the SIP Challenge action for a DoS profile configuration. Avaya phones do not respond when they are authenticated by Avaya after being challenged by Avaya SBC.

Stealth DoS/DDoS tab

Name
Description
Timeslot
The time slots in which DoS attacks are monitored. The options are:
  • Morning (0600–1159)
  • Afternoon (1200–1759)
  • Evening (1800–2359)
  • Night (0000–0559)
SIP Service
The SIP service affected by the DoS attack.
SIP Method
The SIP method displayed on this page, which is the same as the services on the Domain DoS screen. For example, All, REGISTER, INVITE, SUBSCRIBE, PUBLISH, or OPTIONS.
Average Inter-Call Duration Threshold (in seconds)
The number of seconds between calls.
Consecutive Average Inter-Call Duration Threshold Violations
The number of permissible consecutive violations of the Average Inter-Call Duration threshold.
Action
The action to be performed when any threshold is exceeded.
The options are :
  • Alert Only: An alert that displays the DoS incident but the call is not blocked.
  • Block: The call is blocked.
  • SIP Challenge: Authentication is initiated.
    Note:
    You must not select the SIP Challenge action for a DoS profile configuration. Avaya phones do not respond when they are authenticated by Avaya after being challenged by Avaya SBC.

Call Walking tab

Name
Description
SIP Service
The SIP service affected by the DoS attack.
SIP Method
The SIP method displayed on this page, which is the same as the services on the Domain DoS screen. For example, All, REGISTER, INVITE, SUBSCRIBE, PUBLISH, or OPTIONS.
Destinations (per minute)
The number of destinations from which calls are received per minute.
Action
The action performed when any threshold is exceeded.
The options are:
  • Alert Only: An alert that displays the DoS incident but the call is not blocked.
  • Block: The call is blocked.
  • SIP Challenge: Authentication is initiated..
    Note:
    You must not select the SIP Challenge action for a DoS profile configuration. Avaya phones do not respond when they are authenticated by Avaya after being challenged by Avaya SBC.

Whitelist tab

Name
Description
Whitelist URI Group
The whitelisted URI group.