How do I limit the number of concurrent TCP connections from a single source in L4 DDoS; what does the Zombie TCP setting do?

Short answer

There are two rules in the Connection Abuse box of the TCP band in the L4 DDoS Management tab. Total Conn/Src limits the number of TCP connections a source address can keep open at the same time: the default ceiling is Concurrent Limit = 1000 and the rule is in the Monitor mode by default; when Block or Quarantine is selected in the Status field and saved with Save, new connections that exceed the ceiling are dropped or the source is quarantined. The limit is not a per-second rate and is applied only to connections directed to the device (including the client connections of HTTP and L7 TCP vServices; excluding the connections forwarded through a Network vService). Zombie TCP, on the other hand, is not a limit but a timeout setting that determines how long after idle connections are cleaned from the connection table: it comes on with the defaults FIN 10, keepalive 30 and established 14400 seconds.

Background

A TCP connection is opened with a handshake and stays open until one of the two ends closes it. A stateful device keeps a record in the connection table for each open connection. If an attacker opens many connections and keeps them waiting without closing them (e.g. slow request attacks), the connection capacity of the server and the intermediate device is exhausted even though each connection produces little traffic. Therefore, as well as the per-second opening rate, the number of connections open at the same time per source is also limited.

Problem: A Single Source Keeps Many Connections Open

The SYN Flood rules that limit the connection opening rate do not catch a source that opens its connections slowly and keeps them waiting without closing them: a source that opens a single connection per minute also reaches thousands of open connections over time. These connections consume the resources of the device and the servers behind it; connections that stay idle without closing also accumulate in the connection table.

Solution: Two Settings

The two settings are not alternatives to each other; they are in the same box and work together.

Your situation	Suitable method
I want to put a ceiling on the number of connections a source can hold at the same time	Method 1: Total Conn/Src
I want to set how long unclosed or idle connections are kept in the connection table	Method 2: Zombie TCP
The limit should be per vService, at the L7 (HTTP and L7 TCP) connection level	Source IP Connection Protection (L7 DDoS Protection) → What is rate limiting; at which layers is it applied in TR7?

Method 1: Total Conn/Src Recommended

• How it works The TCP connections a source address keeps open at that moment are counted; the new connections of a source that exceeds the ceiling are dropped according to the selected mode, or the source is quarantined. Established sessions are not cut (Total Conn/Src).
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → TCP band → Connection Abuse box → the pencil icon in the Total Conn/Src row
• RequirementL4 DDoS Protection (add-on); the permission to make changes in the Network area
• Scope TCP connections directed to the device in the route table: the client connections of HTTP and L7 TCP vServices are counted; connections forwarded to the backend through a Network vService are not caught by this ceiling
• Exempt sources The sources in the Whitelist & Known Peers list are not counted and not limited

Step-by-Step Configuration

1

Adım 1 Open the L4 DDoS Management tab

In the Left Monitor Panel, Route Tables & L4 DDoS is selected from the category tabs at the top left, the route table is clicked and the L4 DDoS Management tab is opened (accessing the screen).

2

Adım 2 Open the window of the rule

In the Connection Abuse box in the TCP band, the pencil icon of the Total Conn/Src row (its sentence is in the A source may hold at most <limit> connections at once; … format) is clicked; the Rule Settings · Total Conn/Src window opens.

3

Adım 3 Select the mode

The mode is selected in the Status field: Disabled, Monitor (default; measures, does not block), Block (drops the new connections that exceed the ceiling) or Quarantine (blocks the source that exceeds the ceiling for the Quarantine Time duration, 10 minutes by default). It is recommended to first watch the measurement in Monitor, set the ceiling above the legitimate traffic, and then switch to Block or Quarantine.

4

Adım 4 Set the ceiling

The number of connections a source can hold at the same time is written in the Concurrent Limit field. Its default value is 1000; only integers of 1 and above are accepted. The field has no time unit.

5

Adım 5 Save

The Save button is clicked. The change takes effect immediately; there is no separate deployment step. To keep the manually set value from being changed by AI Learning recommendations, the Learning Lock switch in the same window is turned on (default: off); while the lock is on, the learning engine cannot change the limit and the mode of the rule.

Verification

1Rule rowTR7 side

The sentence of the Total Conn/Src row in the Connection Abuse box is read.

ExpectedA source may hold at most 1000 connections at once; anything beyond is dropped

In the Quarantine mode the sentence ends with "a source that exceeds it is quarantined", and in the Monitor mode with "anything beyond is only monitored".

2Dashboard · Connection LimitsTR7 side

On the Dashboard screen of the route table, the Connection Limits tab is opened; the highest source concurrency, the p95 value and the ceiling line are visible in the panel of the rule.

ExpectedSources that exceed the ceiling produce a Dropped Traffic value in the Block/Quarantine mode

The count also covers the connections passed through the device, while the limit is applied only to the connections directed to the device; therefore, Dropped Traffic can stay at zero while a source that exceeds the ceiling is seen in the panel.

Method 2: Zombie TCP

• How it works It does not write a firewall rule; it sets the timeout values that determine how long after the idle records in the connection table are cleaned (Zombie TCP).
• Where it is openedConnection Abuse box → the pencil icon in the Zombie TCP row
• Requirement Same as Method 1
• Scope Route table; it cannot send to quarantine, it is only Enabled or Disabled, and it comes Enabled by default

Step-by-Step Configuration

1

Adım 1 Open the window of the rule

In the Connection Abuse box, the pencil icon of the Zombie TCP row (its sentence is in the Idle TCP connections are reaped: FIN <duration> · keepalive <duration> · established <duration> format) is clicked.

2

Adım 2 Set the durations

The three durations are entered in seconds; all three accept only integers of 1 and above:

Field	Default	What it determines
Fin Timeout(s)	10	How long a connection that has moved to the closing stage is kept waiting in this stage
Keepalive Time(s)	30	The time after which the liveness check starts for an idle connection
Established Timeout(s)	14400	How long an established and idle connection is kept in the table

3

Adım 3 Save

The Status field is left at Enabled and the Save button is clicked.

Verification

1Rule rowTR7 side

The sentence of the Zombie TCP row is read; the durations are written as raw seconds.

ExpectedIdle TCP connections are reaped: FIN 10 · keepalive 30 · established 14400

Zombie TCP has no panel of its own on the Dashboard; its measurement is recorded but not charted in the ready tabs.

Common Mistakes

Keeping Established Timeout too short drops healthy sessions

Quiet but live sessions, such as long-lasting database or remote access connections, drop from the connection table if they stay idle longer than the Established Timeout(s) value. The default of 14400 seconds (4 hours) was chosen with such sessions in mind.

• Thinking Total Conn/Src is a per-second connection rate limit. The rule looks at the question "how many connections are open right now". The connection opening rate is limited with the rules in the SYN Flood box.
• Thinking Network vService traffic is limited too. The limit is applied to connections directed to the device; connections forwarded through a Network vService are not caught by this ceiling even though they appear in the count.
• Switching directly to Block without measuring the ceiling. NAT exits that gather many users behind a single address legitimately reach high concurrency. The rule is first run in Monitor; if needed, these sources are added to the Whitelist & Known Peers list (How do I exempt specific IPs, networks or countries from L4 DDoS protection (Whitelist & Known Peers)?).
• Thinking timeout cleaning stops when Zombie TCP is turned off. When Disabled is selected, the row says Idle TCP connections are not reaped, but the system continues the cleaning with the catalog defaults (10 · 30 · 14400); turning it off only cancels the special values.
• Thinking the setting is applied to all route tables. Both rules are per route table; they are set separately in each route table.

How it is done in the documentation

• Connection Abuse · Total Conn/Src
• Connection Abuse · Zombie TCP
• Connection Abuse · Measurement and Dashboard
• Connection Abuse · Scope and Limits

Related questions

• What is a SYN Flood attack; which rules does TR7 apply against it?
• What do TCP connection states (such as ESTABLISHED and TIME_WAIT) mean?
• What is rate limiting; at which layers is it applied in TR7?
• How do I exempt specific IPs, networks or countries from L4 DDoS protection (Whitelist & Known Peers)?