"Deny Percentage": what is it useful for?

tar_mynastyr · ‎10-28-2008

Hello, everybody.

Today I was revising our strategy for IPS event filtering and one question came to me:

In what practical cases "Deny Percentage" value less than 100% should be (or may be) used?

Thanks in advance!

attmidsteam · ‎10-28-2008

Maybe when you want to give the bad guys a fighting chance?

I could see it being used as a very rough way of imposing QOS on P2P traffic without specific blocking all of the traffic.

tar_mynastyr · ‎10-28-2008

Initially I was also thinking that this feature could conceal the fact that there is an IPS denying some sort of traffic, instead imitating congestion or other network problems.

But I cannot imagine the real use case, even with P2P traffic. It seems like shooting sparrows from a cannon :)