Fortigate IPS udp_flood L4 anomalies - VID285212775 - deep understanding of measurement and raw even

[jtoutee]

Hello,

We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.

The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.

The raw log, as sent by the FW to the FortiSIEM is the following:

<185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 craction=4096 crlevel="critical"

We see that threshold was crossed (5001, which is exactly defined threshold+1, certaninly not 5001 for real) but not by how many pps ?

The fortiguard link http://www.fortinet.com/ids/VID285212775 is dead for weeks so we have little info on how it is implemented. The FTG doc here https://docs.fortinet.com/document/fortigate/7.2.10/administration-guide/771644/dos-policy is not clear on how exactly the alert is triggered.

Questions:

1. On the FTG side how are the pps measured (sampled) ? Is the number of packets cumulated every minute then divided by 60 to get packets par second? Or is this calculation done every 15 minutes?
2. The 'repeat 13 times' : does it mean the 5000pps threshold was crossed 13 times? If yes, over which period of time?

Thanks for your help

Brgds/Jerome

[Anthony_E]

Hello Jerome,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hello Jerome,

Could you please open a TAC ticket: https://support.fortinet.com/welcome

They will provide help.

Regards,

[jtoutee]

ok Anhony, will do.

[jtoutee · Accepted solution]

I did a ticket #10493399 and the answer was (partially) in this doc: 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Information-about-Count-field-in-anomaly-l...

To summarize:

-the FTG L4 anomalies measures fps every 60s (and then divides by 60)

-once 1 alert is issued (threshold crossed) the repeat value is the number of frames which exceeded the threshold since the 1st alert

[Anthony_E]

Thank you Jerome