---
title: Event Per IP Per Path Prefilter Handler
slug: ps/help/en_us/vwaf/ag/event-per-ip-per-path-prefilter-handler
docTags: 
createdAt: 2026-08-02T10:05:40.936Z
---

## Purpose

This special handler triggers the [Requests Per IP Per Path Per Timeframe Per Application Event Source](docId\:NDe7-xev0LZBSrlncb7YU) if within a given period of time there have been more requests from a given IP address range than allowed. As this handler is used on path level, only requests relating to this path are counted.

:::hint{type="info"}
You need to link an event destination group to the [Requests Per IP Per Path Per Timeframe Per Application Event Source](docId\:NDe7-xev0LZBSrlncb7YU) in order to actually trigger an alert.
:::

:::hint{type="info"}
For more information regarding adding and editing Handlers, see [Editing Handlers](docId:7HHz1jewuWOJC-FTlmBZw).
:::

## Severity

Events triggered by this handler are given the severity: medium. (For details on severity levels, see [Severity of Events Triggered by Handlers](docId\:ZAdDmUem6-P614MEP_3aQ)).

## Recommendations for use

Only add this handler if you want to use the [Requests Per IP Per Path Per Timeframe Per Application Event Source](docId\:NDe7-xev0LZBSrlncb7YU).

## Attributes

| Attribute      | Meaning                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| timeframe      | Period of time that vWAF looks at. vWAF can continuously analyze the most recent 1, 5, 30 or 60 minutes.                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| limit          | Number of requests on the path and ip4 range plus ip6 range within the given timeframe that are needed to trigger the event.                                                                                                                                                                                                                                                                                                                                                                                                               |
| ip4 range      | Determines the size of the IPv4 address range that vWAF looks at.<br />- /0 sets a global limit<br />this means that an alert is triggered as soon as there are more requests from all IP addresses combined than the given limit allows<br />- /8 to /24 specifies a range of IP addresses (see [Specifying IP Addresses](docId\:rUMDSCo5lBgjtOsOUsY1-))<br />- /32 sets a limit per IP address<br />this means that an alert is only triggered if there have been more requests from the same IP address than allowed by the given limit |
| ip6 range      | Determines the size of the IPv6 address range that vWAF looks at.<br />- /0 sets a global limit<br />this means that an alert is triggered as soon as there are more requests from all IP addresses combined than the given limit allows<br />- /16 to /64 specifies a range of IP addresses<br />- /128 sets a limit per IP address<br />this means that an alert is only triggered if there have been more requests from the same IP address than allowed by the given limit                                                             |
| usertext       | currently not used                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| enable logging | currently not used                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |

:::hint{type="info"}
For details regarding entries added to the log file by this handler, see the relevant section in [Entries in Application-Specific Log Files](docId\:crbZcvVfRSdEXrvik4Qio).
:::