detect flooding
Hey everyone! I need help designing a scenario for a very specific use case and I'm not sure if it's even possible with CrowdSec's bucket types.
What I want to detect:
- Ban IPs that send 17+ POST requests within 1 second (burst attack)
- Allow IPs that spread their requests over longer periods
Examples:
- 17 POST requests in 1 second → BAN ✓
- 17 POST requests in 2 seconds → ALLOW ✓
- 36 POST requests over 18 seconds → ALLOW ✓
- 346 POST requests over 2 hours → ALLOW ✓
What I've tried:
1. Leaky bucket with
capacity: 16, leakspeed: 1s:
- Problem: It accumulates events over time, so 36 events in 18s triggers a ban (not what I want)
My question:
Is there a way to detect "X or more events within exactly Y seconds" without triggering on lower rates over longer periods?
Should I:
- Use a different bucket configuration?
- Write a custom parser that calculates the rate and emits special events?
- Accept that this isn't possible with scenarios?
Any guidance would be really appreciated! Thanks!14 Replies
Important Information
Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command
/resolve or press the green resolve button below.Log Files
If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.
Guide Followed (CrowdSec Official)
If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.
Screenshots
Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.
© Created By WhyAydan for CrowdSec ❤️
This is not possible with a leaky bucket, the whole point of it is to better detect slow attacks.
A leaky bucket will leak one event after X amount of seconds.
You have two options here:
1. Increase the bucket capacity
2. Reduce the leak speed to something like 0.5 seconds
Option 2 is probably want you want if you want to detect very high volume requests
Okay, thank you.
Unfortunately, that doesn't have the desired effect either.
tried option 2:
Option 1 only reduces the amount of reported incidents.
Would it be possible to use a combination of parser and scenario to map something like this?
Just to make sure I understand, you want to only detect something making more than 17 requests per second, but not (random number) 40 in 3 seconds ?
yes, as soon as more than 17 requests per second are done, the ip should get banned.
Wouldnt it be better to implement a rate limit on the reverse proxy, then you could just detect rate limit abusers instead?
I do not use any reverse proxy, simple apache setup
well apache is webserver / reverse proxy and has mod_ratelimit but I dont know if we support the rate limit logs from apache2
Thank you, I'll take a look at mod_ratelimit.
However, you can also do within a scenario but it will not as performant and could cost alot in memory to track alot of items.
generated by our MCP tool for quick mockup no guarantees it will work or not explode performance
That's a pity :), it reacts similarly to leaky.
oops the mcp forgot an important part
I updated it but yeah it a pretty niche case to detect, there probably more things you could tweak like capacity. However, being honest dont know what happens when a conditional has reached it capacity if the events are fifo
Ok thank you, I will do some more testing with this example.
It still detecs 2s and 4s, but looks better over all.
INFO[2025-11-05T13:41:04+01:00] Ip 62.209.38.148 performed 'crowdsecurity/http-rapid-post-flood' (17 events over 2s) at 2025-11-04 11:09:24 +0100 CET
And thank you for the hint to the mcp server. 👍
you can do a combination of both, raise the capacity and lower the leak speed. The leak speed can be lower than 0.5 seconds, you have to tweak the values to find values right for your environment.