HTTP2.RST_STREAM.Rapid.Reset.DoS

[mussa3]

good morning friends. As you know, there is a zero-day vulnerability "HTTP2.RST_STREAM.Rapid.Reset.DoS" Currently in my firewall I apply what is the IDS (end client request) previously we have already recommended that i should apply the IPS.

I want to block the reported signature but it does not appear in the list of IPS signatures, I have searched for it by CVE but it does not show me results either. Currently this equipment has the IPS version: IPS Definitions: 26.00652

Search another firewall for the signature and if ican find it. IPS Definitions: 25.00655

Is the issue the version of the IPS?

[suwar1]

Honestly maybe m a little BOFH while saying this... but i have found if m being DDoS'ed, a DNS redirect to Google Infrastructure usually "stops the attack" either because nobody wants to mess with Google or because Google engineers null route their exits at the akamai/cloudflare/isp level.

[rosatechnocrat]

Dear Mussa,

Below IPS ('HTTP2.RST_STREAM.Rapid.Reset.DoS) signature is available from Fortiguard. 

www.fortiguard.com/encyclopedia/ips/54090

Hope this helps and answers your query & Please mark the solution as accepted if it answers your query.