120 seconds bucket collection timeout causes attack detection delays
complete
F
FastNetMon
Customer reported that such long timeout may lead to cases when some traffic triggered bucket capture but then no packets matched this this rule appeared to arrive. It happens when BGP Flow Spec mode enabled with threshold_specific_ban_details enabled. It will lead to 120 seconds without detection.
We prefer to avoid exposing it as configuration option as it will add more complexity to our already complex detection engine engine to address it different way
F
FastNetMon
complete
F
FastNetMon
Will be released in 2.0.359
F
FastNetMon
Decreased to 60 and added as configuration option:
sudo fcli set main bucket_traffic_collection_timeout 30