chasten flow

Function

The chasten flow command restricts the maximum number of times HTTPS flows can be established on a device.

The undo chasten flow command restores the default configuration.

By default, the number of HTTPS flow tables to be created is 300, the time for creating the HTTPS flow table is 30 seconds, the block time for HTTPS flow setup is 30 seconds, the TCP SYN packet processing rate in blocking state is 1 per second

This command is supported only on the NetEngine 8000 F1A.

Format

chasten flow connection-sessions connection-period blocking-period blocking-rate

undo chasten flow connection-sessions connection-period blocking-period blocking-rate

Parameters

Parameter	Description	Value
flow connection-sessions	Specifies the number of HTTPS flow tables to be created.	The value is an integer ranging from 1 to 10000.
flow connection-period	Specifies the time for creating the HTTPS flow table.	The value is an integer ranging from 1 to 3600, in seconds.
flow blocking-period	Specifies the block time for HTTPS flow setup.	The value is an integer ranging from 1 to 3600, in seconds.
flow blocking-rate	Specifies the TCP SYN packet processing rate in blocking state.	The value is an integer ranging from 1 to 10, in packets/second.

Views

HTTPS redirect view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
portal	write

Usage Guidelines

Usage Scenario

To prevent some users from using HTTPS TCP SYN packets with changing destination IP addresses to attack the device so that the HTTPS redirection function is not affected for other users, you need to restrict the rate at which HTTPS flows are established. You can run the chasten flow command to configure the number of seconds during which a device is frozen if the number of HTTPS flows established on the device within a specified period exceeds the preset threshold. Within this freezing period, the device discards the extra HTTPS TCP SYN packets sent by the user.

Precautions

In VS mode, this command is supported only by the admin VS.
If both the chasten flow(slot) and chasten flow commands are run, the chasten flow(slot) command configuration takes effect.

Example

# Configure the device to process one TCP SYN packet every second in the next 3000 seconds and discard extra packets after the number of flows established within 3000 seconds reaches 9000.

<HUAWEI> system-view
[~HUAWEI] access https-redirect
[~HUAWEI-access-https-redirect] chasten flow 9000 3000 3000 1