DocsAttack Types

Abnormal Network Behaviour

Behaviour far outside normal that matches no specific signature.

A VM behaves far outside its own normal pattern but matches no known attack. Frabs compares each VM with its own history. By default it alerts your team rather than acting, because unusual is not always abuse.

Detectors (10)

Detector	Measures	Warning	Incident	Critical
Excessive Outbound Connections	Distinct destination addresses (addresses)	1,000 in 1 h	5,000 in 1 h	10,000 in 1 h
Excessive New Connections	New outbound connections per second (conn/s)	500 in 30 s	2,000 in 30 s	5,000 in 30 s
Excessive Destination Count	Distinct destination addresses (addresses)	1,000 in 1 h	5,000 in 1 h	10,000 in 1 h
Excessive Port Count	Distinct destination ports (ports)	100 in 1 min	500 in 5 min	1,000 in 10 min
Excessive Packet Rate	Outbound packets per second (pkt/s)	10,000 in 30 s	50,000 in 30 s	100,000 in 30 s
Excessive Bandwidth	Outbound megabits per second (Mbps)	300 in 1 min	600 in 30 s	1,000 in 15 s
Connection Burst	New outbound connections per second (conn/s)	1,000 in 10 s	5,000 in 10 s	10,000 in 10 s
Destination Burst	Distinct destination addresses (addresses)	500 in 1 min	2,000 in 1 min	5,000 in 1 min
Port Burst	Distinct destination ports (ports)	200 in 10 s	1,000 in 10 s	5,000 in 10 s
Persistent High-Rate Traffic	Outbound packets per second (pkt/s)	10,000 in 30 min	50,000 in 30 min	100,000 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousReconnaissance & Internet-Wide Abuse NextReputation & Abuse Intelligence