Re: [mod-security-users] about ip/IP
Brought to you by:
victorhora,
zimmerletw
|
From: <877...@qq...> - 2021-06-30 02:34:14
|
but I DO NOT find any document that ip (low case) will be translated to brower ip.
------------------ Original ------------------
From: "mod-security-users" <mod...@li...>;
Date: Wed, Jun 30, 2021 10:17 AM
To: "mod-security-users"<mod...@li...>;
Cc: "huiming"<877...@qq...>;
Subject: [mod-security-users] about ip/IP
hi, all:
For below rule, two high lighted IP/ip will be translated to client IP address ? only in this case, it is reasonable.
SecRule IP:DOS_BURST_COUNTER "@ge 1" \
"id:912171,\
phase:5,\
pass,\
t:none,\
log,\
msg:'Potential Denial of Service (DoS) Attack from %{tx.real_ip} - # of Request Bursts: %{ip.dos_burst_counter}',\
tag:'application-multi',\
tag:'language-multi',\
tag:'platform-multi',\
tag:'attack-dos',\
tag:'paranoia-level/2',\
ver:'OWASP_CRS/3.2.0',\
setvar:'ip.dos_block=1',\
expirevar:'ip.dos_block=%{tx.dos_block_timeout}'"
Thanks
huiming |