Technical Note: Most Active Source graph

FortiDDoS

FortiDDoS protects from both known and zero day attacks with very low latency. It’s easy to deploy and manage, and includes comprehensive reporting and analysis tools.

Article Id 196421

Description

There are more packets/sec reported for the Most Active Source graph compared to what the FortiDDoS is actually receiving/sending for that source and also compared to other graphs.

Scope

All FortiDDoS.

Solution

For TCP and DNS traffic, the MAS will add up both directions. Wherever a session is detected it is associated with both inbound and outbound traffic to its source for Most Active Source. This is to catch the offending sources in a faster way. Since this client creates the session, the source can be identified and punished more rapidly.

489

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.