Tables in FortiDDoS models are sized to exceed high flood conditions. In the very unlikely event that Memory tables such as Source, Destination, and Session tables fill under flood, the system provides an option to drop packets that exceed the capacity of the tables or to bypass those packets with no mitigation.

Select either of the following options:

• Drop — This is the preferred option since the tables will only fill under severe flood (or misconfigured systems).

• Bypass — This is the default option.

If system-wide drops for each 5-minute cycle exceed the threshold entered here, an Attack Flag MIB object fddGlobalAttackFlag is set to 1 and can be polled for the next 5 minutes. At each 5-minute cycle the threshold is evaluated and set to 1 if drops are over the entered threshold or 0 if under the entered threshold.

Threshold default is 1,000,000,000 and range is 0-1000000000.

Note: All changes for any 5-minute cycle take place at 2 minutes after the 5-minute period. This flag becomes valid at :02, :07, :12, :17, etc. to :57.

See the SPP configuration section for additional options and See Appendix C for more MIB information.

Use case: A simple “Under Attack / Not Under Attack” flag for downstream manager dashboards.

Note: System drop counts can be polled from FortiDDoS every 5 minutes using MIB Objects fddGlobalInboundDrops / fddGlobalOutboundDrops