Available expression fields

You can use the following fields in override expressions for the Network-layer DDoS Attack Protection Managed Ruleset:

• ip.src
• ip.dst
• ip.proto.num
• ip.len
• ip.ttl
• tcp.srcport
• tcp.dstport
• tcp.flags
• tcp.flags.ack
• tcp.flags.fin
• tcp.flags.push
• tcp.flags.reset
• tcp.flags.syn
• tcp.flags.urg
• udp.srcport
• udp.dstport

Refer to Fields in the Rules language documentation for more information.