FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

How does WAF inspection behave under heavy traffic? ​

Short answer

Under load as well, WAF scans every request that enters inspection with the same rules; there is no mechanism that skips or loosens the inspection by itself when the load increases. The capacity is determined by the CPU cores and the memory reserved for the vService; dedicated cores and memory are reserved for critical vServices with QoS. In Blocking Mode, a request whose scan cannot be completed within the 2-second time limit is blocked; if Fail-open in the Request Body Limits window is on, this request is passed without being scanned. On a vService with WAF on, the request buffer grows to the larger of the Max. Body Size to Process(kB) (4096 when WAF is turned on) and Buffer Size(kB) values; as the buffer is enlarged, the memory consumption increases under heavy concurrent traffic. Against volume attacks, WAF alone is not the right tool: since the blocking decisions of L7 DDoS & Threat Protection are applied after the WAF scan, the requests it will drop are also scanned in WAF first; floods at the connection and network layer are met by L4 DDoS Protection. Static content and the requests that match Whitelist Condition do not enter inspection and reduce the load. The load is monitored with the CPU, Memory Usage and HTTP Request/s cards in Live Stats, in a separate column per device in a cluster.

Under Load ​

TopicBehavior
Skipping inspectionThe load does not change the inspection; every request that enters inspection is scanned with the same rules
CapacityThe cores and memory reserved for the vService; reserved with QoS (What is QoS; how do I reserve dedicated CPU/memory resources for critical vServices?, What do the Memory Limit, Cores, CPU Priority, Cpu usage limit and Inline Mode settings in QoS do?)
MemoryThe request buffer is the larger of Max. Body Size to Process(kB) and Buffer Size(kB) (How do large request bodies (file uploads) affect WAF performance?)
2-second limitIn Blocking Mode, a request whose scan cannot be completed within the time is blocked; if Fail-open is on, it is passed without being scanned (What happens to a request if the scan exceeds a certain time (2-second scan limit)?)
Volume attackThe L7 DDoS & Threat Protection decisions are applied after WAF; for the connection and network layer, L4 DDoS Protection (What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?)
What does not enter inspectionStatic content and the requests that match Whitelist Condition (What does excluding static content from inspection gain in performance?)

Common Misconceptions ​

  • "When the load increases, WAF loosens the inspection by itself." The WAF inspection does not change according to the load. In Blocking mode, a request whose scan cannot be completed within the 2-second time limit is blocked if Fail-open is off (default); Fail-open is not a load-dependent setting, it affects only the requests whose scan cannot be completed (What happens to a request if the scan exceeds a certain time (2-second scan limit)?).
  • "The requests dropped by L7 DDoS & Threat Protection never reach WAF." The blocking decisions of L7 DDoS & Threat Protection are applied after the WAF scan.
  • "Max. Body Size to Process (kB) affects only the requests with large bodies." The request buffer grows across the vService to the Max. Body Size to Process(kB) value (or to the Buffer Size(kB) value if it is larger).

How it is done in the documentation

Related questions