FortiDDoS URL hashes

[AtiT]

Hi, We are deploying FortiDDoS 400B OSv4.1. I made some tests and under the Log & Report -> Attack Graphs I can see hash index 4842 and the droped packets in the graph Top Attacked URLs(Hash Index). How I can find out the URL that was attacked? Just number 4842 does not mean for me anything.

[Sean_Toomey_FTNT]

Hi AtiT, I will start by saying that I am not a FortiDDoS guru so will do my level best to help here. I checked out the Attack Graphs page and it does indeed appear to be just a snapshot of different graphs, and I can' t find a way currently to drill down to get more information. That' s a good usability idea and I will pass it on internally. Obviously there are the logs you can look at, but you may look at configuring the " My Graphs" section of FortiDDoS. You can specify URL' s or have it build this info from a traffic report you generate. Check http://docs-legacy.fortinet.com/fddos/4-1-1/index.html#page/FortiDDoS_Handbook/my_graphs.html You are also free to open a case with TAC on this, they have people that specialize in this product that might know it off the top of their head. Cheers!

[AtiT]

Hi Sean, Thank you for reply. Configure My Graphs is not really a solution. We are running on version 4.0.1 where the My graph is limited up to 5 entries. In case you want to monitor more URLs (and we want - we want monitor all URLs) it is useless. Your link is for version 4.1.1 where is written: It adds the top 5 entries in the report for each graph. -- so it seems that the limitation is still there. The 4.1.1 folder is empty on support pages and the 4.1.0 is not available for download - you have to ask the TAC. The TAC fistly said that it would be available in version 4.0. patch 1 but it isn' t. For the second time said that we had to ask for it as a feature request. So probably this feature will not be implemented. I just do not understand why it is so hard to log the URL also. When it can log a hash for an URL at the same time when it calculates the hash from the URL it can also log the URL. I do not know where is the problem.

[Sean_Toomey_FTNT]

Looks like 4.1.1 was just released in the last week or so. It' s marked GA in the internal system, but looks like they wanted to fine tune the upgrade procedures for the B series. You can contact TAC and they can get you the file and the appropriate instructions. Sounds like you' ve already talked to TAC about this one, and again I focus on a different set of products, so my presence here is really more of a facilitating agent than me being able to directly answer your questions. Being able to tell the URL that was attacked is a reasonable request for this kind of product, but one that I think the " Top 5" would fulfill, as assumably any URL that was under attack would jump to the top of the list (or near it) for attacks. Have you asked TAC specifically what the best way to get this info is? As to being able to monitor all URL' s, sounds like you were told this would be a feature request? It does seem strange to me that it does not log the URL that is under attack - have you confirmed in the logs that it does not? There is a difference between whether it doesn' t collect the info at all, vs whether it shows that info in a meaningful manner, which is why I ask. I can tell you that they are continuing to evolve the product and add features, so if it truly doesn' t have the functionality you are looking for, a feature request would be the right way to go about it. If you can confirm that the latest version does not do what you need it to on any of these points, working through TAC first to ensure we have covered those bases, I will see what I can work up internally to get forward momentum on this. Cheers!