Overview

Application Scenarios

If you find that your website becomes slow and its network bandwidth usage jumps high, the website may suffer from CC attacks. In this case, check whether the number of access logs or network connections increases sharply. If yes, your website is suffering from CC attacks. Then you can configure a protection rule to protect your website from CC attacks.

WAF protects application-layer traffic against DoS attacks, such as HTTP GET attacks.
WAF does not protect your website at or below layer 4 against DDoS traffic, such as ACK Flood and UDP flood attacks. Anti-DDoS and Advanced Anti-DDoS (AAD) are recommended to defend against such attacks.

This section guides you through configuring IP address-based rate limiting and cookie-based protection rules to defend against Challenge Collapsar (CC) attacks.

Solution Selection

Solution 1: Configuring CC Attack Protection for Common Scenarios
You can have a quick glance to learn how to set WAF protection in the similar scenarios to protect your services.
Solution 2: Limiting Traffic Through IP Address-based Rate Limiting
If no proxy is used between WAF and web visitors, limiting traffic by source IP address is an effective way to detect attacks. IP address-based rate limiting rules are recommended.
Solution 3: Limiting Traffic Based on the Cookie Field
In some cases, WAF cannot obtain the source IP addresses of visitors due to website settings. For example, websites use proxies, but the X-Forwarded-For field is not inserted into the request header. In these cases, cookie-based rate limiting rules are recommended.
Solution 4: Limiting Malicious Requests in Promotions by Using Cookies and HWWAFSESID
This solution works well in limiting malicious requests originated from different IP addresses and terminals but the same account and malicious requests originated from different accounts but the same PC.

Advantages

This practice provides a solution to help quickly defend against CC attacks in multiple scenarios.

Resource and Cost Planning

**Table 1** Resources and costs
Resource	Description	Monthly Fee
Web Application Firewall	Cloud - Standard edition Billing mode: Yearly/Monthly Domain name quota: 10, including a maximum of one top-level domain name QPS quota: 2,000 QPS Peak bandwidth: 100 Mbit/s inside the cloud and 30 Mbit/s outside the cloud	For details about pricing rules, see Billing Description.