Understanding Memory and Session Limit Settings for Junos OS Application Identification Services

You can configure settings to limit the number of sessions running application identification and also limit memory usage for application identification.

• Memory limit for a session—You can configure the maximum amount of memory bytes that can be used to save packets for application identification for one TCP or UDP session. You can also configure a limit for global memory usage for application identification. Application identification is disabled for a session after the system reaches the specified memory limit for the session. However, application identification continues to match patterns. The matched application is saved to cache so that the next session can use it. This protects the system from attackers trying to bypass application identification by purposely sending large client-to-server packets.
• Number of sessions—You can configure the maximum number of sessions that can run application identification at the same time. Application identification is disabled after the system reaches the specified number of sessions. You limit the number of sessions so that you can prevent a denial-of-service (DoS) attack, which occurs when too many connection requests overwhelm and exhaust all the allocated resources on the system.

Table 75 shows the session capacity for a central point (CP) for SRX3400, SRX3600, SRX5600, and SRX5800 devices.

Related Topics

• Junos OS Feature Support Reference for SRX Series and J Series Devices
• Understanding Junos OS Application Identification Services
• Example: Setting Memory and Session Limits for IDP Application Identification (CLI)