Smart Defence

[thefunkygibbon]

Can anyone tell me how exactly to find out which Smartdefence module is kicking in?

ie i'm getting something blocked with the smartdefence icon in it via http but there is nothing in the comments section so do not know which smartdefence module to tweak/disable.

I've noticed that this is the case for every other smartdefence block in my logs too.

[srikrishnak]

You can try to understand from the information field. For example if it says the packet dropped due to "TCP flags doesnt make sense"; then this is because TCP SYN attack configuration in SmartDefence.

Agree with you its not so clear but out there in the market this is the best product.

[intehnet]

are you looking at the "smart defense" logs? or the "All" logs
look at double click, or filter by product, Smart Defense

Might give more information..

[flawless_cowboy]

Sounds like you are running R55, in which sometimes the discriptions where bad or just didnt exist. NGX does a much better job about logging information related to smart defense/web intelligence.

[thefunkygibbon]

sorry guys yes i was being thick, i am running ngx but hadnt used the tab on the left for smartdefence only rules and it gives a whole bunch of details.

Although it still doesnt tell you the exact rule it makes it a little easier to work out whats causing it.

thanks guys