Dos Policy: tcp_src_session

It’s how many sessions a single source IP address can have. So a threshold of 30 would mean a client can have up to 30 active TCP sessions open at the same time. The rate at which they are created does not matter. You could have 1 million clients hitting, but each client will be limited to 30 active TCP sessions before your Action triggers.

Hi aldaf3i,

The existing explanation is correct. To add a little more context, the tcp_src_session anomaly is based on the number of concurrent TCP connections from a single source IP, not on the number of sessions created within a time interval.

Therefore, if you configure:

Threshold = 30

it means that 30 concurrent TCP sessions from the same source IP is the configured threshold. It does not mean 30 sessions per 60 seconds.

Fortinet documents tcp_src_session specifically as: “If the number of concurrent TCP connections from one source IP address exceeds the configured threshold value, the action is executed.”

So the key distinction is:

tcp_src_session → concurrent sessions
Not → sessions per second/minute

Hope this clarifies the meaning of the threshold.