14. Network & Policy » Threshold Template

To add a new Threshold Template, go to Configuration » Network & Policy, click the [+] button from the title bar, and then select [Threshold Template]. Threshold Templates are mainly used to add identical thresholds to multiple prefixes.

The top bar of the Threshold Template Configuration window carries the name of the template next to [Rename], the [Batch] menu, and [Delete], which asks for confirmation before removing the template. On the right-hand side, [List Prefixes] shows the prefixes that currently use it. The [Batch] menu holds [Restore from File], which opens the Backup File Importer & Tester and whose Conflict Policy decides whether the rules that already exist are left alone or overwritten, [Duplicate Threshold Template], and [Backup to File]. Under the rules sits a collapsed Comments section for free-form notes, and [Save] writes the template. When your role grants read-only access to templates, the window title is suffixed with [READ-ONLY] and the editing controls are disabled.

The rules are managed with [Add Rule], [Edit Rule], and [Delete Rule(s)] — the grid accepts multiple selections — or by double-clicking a row to edit it in place.

Every threshold rule contains the following metrics:

● Domain – Inside a Threshold Template, this is either Internal IP, which detects anomalies to/from an individual IP of the prefix the template is attached to, or Subnet, which takes that prefix as a whole. When the same rules are edited directly on a prefix of an IP Zone, the list grows with the options that the prefix’s mask allows: any included subnet with a longer prefix, from /20 to /30 for IPv4 and from /36 to /64 (in steps of 4) for IPv6. If the selected subnet is 0.0.0.0/0, another option is possible, which allows detecting anomalies to/from external IPs (for this option to work, the Stats Engine parameter from the Sensor configuration has to be set accordingly)

● Direction – The direction of traffic can be receives for the inbound traffic received by the prefix or sends for the outbound traffic sent by the prefix

● Decoder – Select one of the decoders enabled in General Settings » Anomaly Detection

● Unit – DDoS attacks usually reach a very high number of packets per second, so the pkts/s option is the best way to detect them. For bandwidth-related anomalies, select bits/s

● Comparison – Select over to detect volumetric anomalies (e.g., DrDoS, DDoS), or under to detect a gap in the expected traffic

● Value – The threshold value can contain:

▪ An absolute value. It can be a multiple of 1,000 if “K” (kilo) is appended, 1 million if “M” is appended, or 1 billion if “G” is appended

▪ A percentage of the total traffic matched by the selected decoder per Sensor interface. Percentages above 100% are refused

▪ Unlimited, which cancels a threshold inherited from a less specific prefix

● Response – Select a previously defined Response, or select None to have no reaction to anomalies other than displaying them in Reports » Tools » Anomalies » Active Anomalies. Every rule must name one

● Parent – Tick the checkbox if more specific prefixes should inherit the threshold; the column then reads Yes. You can cancel inherited thresholds by defining a similar threshold with Unlimited selected in the Value field

● Inheritance – Shown only when the rules are attached to a prefix of an IP Zone; displays the parent prefix when the rule is inherited from a less specific prefix

For example, a threshold rule on 0.0.0.0/0 that reads “Internal IP receives over 5% TCP+SYN pkts/s” can detect significant SYN attacks on any IP in your network. Another rule, “Subnet sends under 1 bits/s,” can trigger a Response when the link goes down.

The rules are validated when you click [Save]. Empty values, zero values, percentages above 100%, and rules without a Response are refused. Duplicates are refused as well: two rules count as identical when they share Domain, Direction, Decoder, Unit, Comparison, and kind of value, whatever value or Response they carry. An absolute rule and a percentage rule of otherwise identical shape are not duplicates, so both can coexist.

The order of the rules can be rearranged with drag and drop. Click the [Group by Unit] button to combine the pkts/s and bits/s rules that share the same Domain, Direction, Decoder, Comparison, Response, and Parent into single rows, which makes large rule sets easier to review. The Unit and Value columns are then replaced by a Pkts/s and a Bits/s column, and a group with no rule for one of the two units shows Undefined in the corresponding column. When rules that would share a row differ in their Response or Parent, or duplicate one another, the Console refuses to group them and lists the offending rules instead.

Threshold Templates can be exported to a file with [Backup to File] and imported on another Console, making it easy to copy a proven set of thresholds across deployments.

Note

Adding similar threshold rules in the same prefix or Threshold Template is not allowed, even when the rules have different values or Responses. To execute different actions for different threshold values, define only the smallest threshold value, and then make use of preconditions inside the Response. For example, if you want to activate Wanguard Filter for UDP attacks stronger than 100 Mbps but you also want to null-route them when they reach 1 Gbps, add only the “Internal IP receives over 100M UDP bits/s” rule. Then, inside the Response add two actions: one that activates Filter without preconditions, and another that executes the null-routing BGP announcement with the precondition “Peak Value” “greater than” “1G”.

14.1. Best Practices for Traffic Thresholds

✔ TCP+SYN thresholds on IPs should be configured to low values, usually at around 500-1000 packets/s. TCP uses packets with the SYN flag set only when establishing new TCP connections; very few services (e.g., high volume websites) are able to handle more than 1000 new TCP connections every second. SYN packets are used for SYN flooding

✔ TCP bits/s thresholds should be configured to your maximum bandwidth level per IP. TCP packets carry on average around 500 bytes of data. Setting a threshold of 15k TCP packets/s should be enough for medium-sized networks

✔ ICMP thresholds should be configured to very low levels, 50-100 packets/s. ICMP is used for Ping flooding, while legitimate ICMP traffic is never above a few packets/s

✔ UDP traffic usually exhibits high packets/s and low bits/s values, so you can configure low values for bits/s. Setting UDP packets/s thresholds at around 15k/s per destination should not generate false positives while catching significant UDP flood attacks. A special attention has to be paid lately to the QUIC protocol, which encapsulates high-bandwidth HTTP traffic inside UDP packets

✔ OTHER decoder matches all non-TCP, non-UDP, and non-ICMP traffic. You can configure thresholds for OTHER if you have non-standard applications in your network. Over 90% of Internet traffic is either TCP or UDP

✔ Enable additional decoders, such as HTTP, MAIL, NTP, etc., to configure thresholds for specific services and servers. Most DDoS amplification attacks are captured by the following decoders: MEMCACHED, NTP, SSDP, CHARGEN, CLDAP, SLP, ARMS, COAP, MSSQLRS, STUN, WSDD, RIPV1, MDNS, RPCBIND, NBNS

✔ If you open an IP Zone and select 0.0.0.0/0, you will be able to configure thresholds for external IPs (IPs not belonging to your network). This is useful to catch external IPs that scan or attack your network with very few packets sent to each of your IPs

✔ Consider adding “unallocated” or “illegal” IP address ranges—those that should never appear in your normal traffic. With small thresholds, you can identify malicious activities such as scans and worms

Warning

The software is designed to collect, analyze, and report extensive information for each detected anomaly. This level of detail is essential for protecting against volumetric attacks that can cripple even the largest networks. Avoid setting thresholds too low, as doing so may generate hundreds of false/minor anomalies from normal traffic and overload the system.

Adjust the default threshold values to match your specific environment and traffic patterns.