What is a botnet; how does TR7 detect a distributed attack originating from a botnet?

Short answer

A botnet is a network formed by a large number of devices (servers, computers, IoT devices) that an attacker has taken over and manages remotely (NIST definition); it is used as a common source in attacks such as DDoS, brute-force and spam. When each participant sends a small number of requests, per-source limits may not be triggered; the strength of the attack comes from the number of sources. In TR7, this situation is caught by Active Source-IP Protection in L7 DDoS Protection: it measures the number of different source addresses that produce traffic in a 10-second fixed window, that is, the width of the traffic; when the number exceeds the Active Source-IP Limit (10s) value (default 10,000), the selected action (default Silent Drop) is applied. Known botnet and DDoS sources are kept in the DDoS Attack category in the IP Intelligence & Reputation database.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → L7 DDoS Protection	Active Source-IP Protection block	Limiting the number of different addresses that produce traffic in the same window
L7 DDoS Protection card	Total Request Protection, Total Connection Protection	Limiting the total volume coming to the vService, independently of the number of sources
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP Categories → DDoS Attack, Exploited Host	Addresses known to have taken part in DDoS attacks; devices infected with malware and used in other attacks
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	IP Reputation Protection card	Putting the addresses in the DDoS Attack and Exploited Host categories into Quarantine by default

Common Misconceptions

• "A per-source limit stops a botnet." Each participant can stay below the per-source limit; a distributed attack is caught by its width with Active Source-IP Protection, and by its total volume with Total Request Protection.
• "A botnet consists only of personal computers." Compromised servers and IoT devices can also be part of a botnet.
• "Active Source-IP Protection blocks the moment it is turned on." The block is on by default, but L7 DDoS Protection starts in Monitor mode when the protection is turned on; in this mode, the block only measures and produces events.

How it is done in the documentation

• Active Source-IP Protection · What Is Active Source-IP Protection?
• IP Intelligence & Reputation · Why Is It Important?
• IP Reputation Protection · The Default Rules

Related questions

• What is a DDoS attack; at which layers does TR7 provide DDoS protection?
• What is IP Reputation; where does TR7 use IP Reputation data?
• What is a bot; how is the difference between a good bot and a bad bot handled in TR7?