<?xml version="1.0" encoding="UTF-8"?>

<raptor xmlns:action="http://martin-weusten.de/raptor/action" xmlns:check="http://martin-weusten.de/raptor/check">
	<name>FloodDetection</name>
	<desc>This example is a simple flood detection. If it detects a flood all packets from the user are droped for the next 10 minutes.</desc>
	<version>2</version>
	<counter name="TIMER" interval="1000" decrement="1"/>     
	<counter name="TRAFFIC" interval="2000" decrement="100"/>
	<function name="MAIN">
		<action:rule>
			<if>
				<check:count counter="TIMER" count="FROM" compare="GREATER" ref="0"/>
			</if>
			<then>
				<action:drop/>
			</then>
		</action:rule>
		<action:count counter="TRAFFIC" count="FROM"/>
		<action:rule>
			<if>
				<check:set_count counter="TRAFFIC" count="FROM" compare="GREATER" ref="1500" newvalue="0"/>
			</if>
			<then>
				<action:set_count counter="TIMER" count="FROM" newvalue="600"/>
				<action:log>Flood from user '\F' with IP=\I. Dropping all packets from this user for 10 minutes.</action:log>
				<action:drop/>
			</then>
		</action:rule>
	</function>
</raptor>

