Attack Types
Broadly speaking, RioRey's 25 Attack Types (AT) and their accompanying algorithms can be classified by their underlying protocol: TCP, UDP, ICMP, or HTTP. Additionally, there are more general controls to allow things such as allow or block listing traffic, configuring regexes, or more general rule based configuration of allowed traffic.
All Attack Types have two concepts common across all of their controls:
- Each AT can be configured independently for different levels of notification thresholds.
- Each AT can be configured for a different filtering mode. These can be configured independently, or set all at once across the zone using zone traffic controls:
- Auto- In this mode, the algorithm works according to its current settings, and if it detects an attack will automatically drop it.
- Monitor- In this mode, the algorithm works according to its current settings, and if it detects an attack it will record there is an ongoing attack but it will not drop any traffic.
- Off- In this mode, the algorithm is disabled and it performs no analysis on traffic. If all algorithms are set to "off" this effectively forwards all traffic automatically.
TCP Based
- AT1: SYN Flood
- AT2: SYN-ACK Flood
- AT3: ACK and PUSH ACK Flood
- AT4: Fragmented ACK
- AT5: RST or FIN Flood
- AT6: Synonymous IP
- AT7: Fake Session
- AT8: Session Attack
- AT9: Misused Application Attack
TCP-HTTP Based
- AT10: HTTP Fragmentation
- AT11: Excessive VERB
- AT12: Excessive VERB Single Session
- AT13: Multiple VERB Single Request
- AT14: Recursive GET
- AT15: Random Recursive GET
- AT16: Faulty Application
UDP Based
- AT17: UDP Flood
- AT18: UDP Fragmentation
- AT19: DNS Flood
- AT20: VoIP Flood
- AT21: Media Data Flood
- AT22: Non-Spoofed UDP Flood