Help Center/ Anti-DDoS Service/ User Guide/ CNAD Advanced (CNAD) Operation Guide/ Adding a Protection Policy/ Setting a Traffic Handling Policy Based on Fingerprint Features
Updated on 2026-07-06 GMT+08:00
View PDF
Share

Setting a Traffic Handling Policy Based on Fingerprint Features

Fingerprint filtering is a core Anti-DDoS policy. It analyzes attack traffic characteristics and generates unique fingerprints to distinguish normal traffic from malicious traffic. During traffic scrubbing, the system matches data packet characteristics, including the protocol, source and destination ports, packet length, and payload content. Based on the matching results, the system applies actions such as pass, discard, source rate limiting, pass and whitelist, discard and blacklist, or rate limiting. Fingerprint filtering improves mitigation accuracy and efficiency, reduces false positives and false negatives, and ensures your services run stably.

Limitations and Constraints

By default, you can add two fingerprint rules. If you need to increase the quota, submit a service ticket.

Enabling Fingerprint Filtering

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Cloud Native Anti-DDoS Advanced > Protection Policies. The Protection Policies page is displayed.
  3. Click Create Protection Policy.
  4. In the displayed dialog box, set the policy name, select an instance, and click OK.

    Figure 1 Creating a policy

  5. In the row containing the target policy, click Set Protection Policy in the Operation column.
  6. In the Fingerprint Filtering configuration area, click Set.

    Figure 2 Fingerprint filtering configuration box

  7. In the displayed Fingerprint Filtering Settings dialog box, click Create Fingerprint.
  8. In the displayed dialog box, set fingerprint parameters.

    Figure 3 Creating a fingerprint
    Table 1 Fingerprint parameters

    Parameter

    Description

    Fingerprint Name

    Enter the fingerprint rule name.

    Protocol

    Set the fingerprint protocol. The value can be UDP or TCP.

    Source Port

    Range of the fingerprint source port.

    Value range: 1 to 65535.

    Constraint: The end port number must be greater than or equal to the start port number.

    Destination Port

    Range of the fingerprint destination port.

    Value range: 1 to 65535.

    Constraint: The end port number must be greater than or equal to the start port number.

    Packet Length Filtering

    Length of the traffic packet to be filtered out.

    Packet Payload Characteristics
    • Test Load: Set the hexadecimal value of the detection payload. Enter 2 to 128 characters.
    • Offset: Set the offset of the fingerprint. The value ranges from 0 to 1500.

    For instance, if the test load is 1234afee and the offset is 20, and the content from the 21st to 32nd bytes of the data area matches 1234afee, the packet is considered to match the fingerprint.

    Action

    Set the response action for matched traffic.

    • Allow: Allow traffic through.
    • Discard: Discard traffic.
    • Rate limiting (source): Requests from a specific source are limited. For example, if traffic from an IP address (or user) exceeds the rate limit you configured in this rule, CNAD will limit the traffic rate.
    • Allow & whitelist: Allow the traffic and add the fingerprint feature to the whitelist.
    • Discard & blacklist: Discard the traffic and add the fingerprint feature to the blacklist.
    • Rate Limit: Limits the traffic access rate.

  9. Click OK.

Follow-up Procedure

  • Locate the row that contains the target port and click Delete in the Operation column to delete the fingerprint filtering rule.
  • Locate the row that contains the target port, click Edit in the Operation column to modify the fingerprint filtering rule.
Parent Topic: Adding a Protection Policy