Protection Features

The Virtual Traffic Manager is a robust solution that is not affected by known classes of exploits. For example, they are believed to be invulnerable to all known worms and malformed HTTP attacks. In addition, since the Virtual Traffic Manager is placed at the point of ingress for traffic to your clusters - and is able to make intelligent routing decisions - it can help defend your platform from obvious network attacks and filter malicious content transparently. This is particularly effective if your back-end servers use a private network rather than having Internet IP addresses.

The Virtual Traffic Manager is also equipped with “Service Protection” features, which can be configured for each virtual server independently. These features allow requests to be managed and filtered dynamically in a number of ways.

The source IP address of a client can be used to decide whether or not to accept requests. If a particular IP address or network block is generating malicious requests, the Virtual Traffic Manager can be configured to drop all connections efficiently from these addresses, thus protecting the back-end pools from attack.

Often, clients abusing a system generate abnormally large numbers of connections. The Virtual Traffic Manager is able to detect and filter unusually heavy activity, based on the traffic from the top 10 busiest IP addresses or on the number of connections per minute being made from each IP address. This allows the Virtual Traffic Manager to deny access to clients making overly intensive requests to your systems.

The Virtual Traffic Manager is able to detect and reject certain classes of malformed HTTP requests, and enforce standards-compliant requests from clients. For instance, the Virtual Traffic Manager can filter binary data from requests and prevent very large headers being used as a vector for a DoS attack.

The Virtual Traffic Manager service protection system can be configured to screen all incoming requests so that any matching the specified criteria are dropped. This functionality can be used to protect your system against known vulnerabilities in third-party applications running on your websites. For example, some business-critical applications such as shopping carts are sometimes found to have insecurities that are triggered by requesting a URL containing badly formed parameters.

The forms of these requests are often made public on security mailing lists. The Virtual Traffic Manager service protection system enables you to use this information to filter out any requests containing these badly formed parameters, so that you can resolve these vulnerabilities quickly and easily across all your websites.

You can configure the Virtual Traffic Manager to block requests by building up a list of rules that are used to filter all incoming requests. In addition you can limit the sizes of requests and the format of the information they can contain.