Custom signature with ‑‑track client cannot be created

[AtiT]

Hello, I want to create custom signature to firstly monitor HTTP GET and later on to block high GET rate. I created the following signature: F-SBID( --attack_id 9851; --name " GET_per_second" ; --pattern " get" ; --service HTTP; --protocol tcp; --no_case; --rate 10,1; ) I want to add the ‑‑track client; parameter like: F-SBID( --attack_id 9851; --name " GET_per_second" ; --pattern " get" ; --service HTTP; --protocol tcp; --no_case; --rate 10,1; ‑‑track client; ) But I cannot create it because after clicking to OK it says: Index out of range. I found the ‑‑track client; in documentaion here: http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/ips_signatures.153.4.html Can anyone explain me what I am doing wrong? Thank you! FYI: I am testing it in the lab on FG-80C with OS 5.0.9

[emnoc]

This why I would use tsahrk/wireshark against some real or pcap files to get an ideal of the number of request. i.e tshark -q -z http,stat," io,stat,1,COUNT(http.request.method)http.request.method==" GET" " you can dump the statistics and build a simple excel or gnuplot of traffic to your webserver

[AtiT]

Wireshark is used on the machine where the test website is running. That is the reason of my previous post that is not working as I would like to. I am generating 11 GETs within 0.7 second and with the --rate 10,1; I see 2 logs which is not what I want - as described in the earliest post.

[emnoc]

I think netmin broken it down pretty straight forward on the logging based on duration and events.