about ip/IP

huiming via mod-security-users <[email protected]> Wed, 30 Jun 2021 10:17:30 +0800

Newsgroups	gmane.comp.apache.mod-security.user
Message-ID	<[email protected]>

hi, all:


For below rule, two high lighted IP/ip will be translated to client IP address ? only in this case, it is reasonable.


SecRule IP:DOS_BURST_COUNTER "@ge 1" \
&nbsp; &nbsp; "id:912171,\
&nbsp; &nbsp; phase:5,\
&nbsp; &nbsp; pass,\
&nbsp; &nbsp; t:none,\
&nbsp; &nbsp; log,\
&nbsp; &nbsp; msg:'Potential Denial of Service (DoS) Attack from %{tx.real_ip} - # of Request Bursts: %{ip.dos_burst_counter}',\
&nbsp; &nbsp; tag:'application-multi',\
&nbsp; &nbsp; tag:'language-multi',\
&nbsp; &nbsp; tag:'platform-multi',\
&nbsp; &nbsp; tag:'attack-dos',\
&nbsp; &nbsp; tag:'paranoia-level/2',\
&nbsp; &nbsp; ver:'OWASP_CRS/3.2.0',\
&nbsp; &nbsp; setvar:'ip.dos_block=1',\
&nbsp; &nbsp; expirevar:'ip.dos_block=%{tx.dos_block_timeout}'"





Thanks
huiming

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/