Flood and Scan
Flood and scan controls
Purpose
Document port-scan, UDP flood, distributed-attack, and subnet-escalation as they exist, without turning YAML threshold names into a performance specification.
Port scan
Agent rules.port_scan.enabled, threshold, time_window, block_duration. eBPF + userspace. Enterprise zwallctl local-tracker inspects port_scan_tracker. Outbound port-scan log types are observe-oriented (Manager will not infer blocked when action omitted).
UDP flood
Manager security.udp_flood (threshold_pps, threshold_bps, sample interval, block duration, whitelist ports/IPs). APIs under /api/v1/security/udp-flood/*. Per-agent config exists. Publishing those integers as a product PPS rating is forbidden.
Distributed attack / subnet escalation
/api/v1/security/distributed-attacks, /attack-candidates, /netblock-*. YAML security.distributed_attack / security.subnet_escalation. Auto-block flags are operator-owned.
POST /api/v1/security/analyze-now is not a daily operator button.
SMTP controls
security.smtp_proxy / SMTP APIs and ebpf/smtp_dnat.c are specialized. Not a mail-gateway product page.
Verification
Enterprise GET /api/v1/dashboard/ebpf-health (Community handler missing). Testing mode may hide live drops. Security logs for scan/flood types.
Do not
- Quote PPS as a SKU
- Leave UDP auto-block on without a port whitelist for DNS/NTP you need
- Expect Hosting Agents to drop floods