Once you have selected which resources you are looking to protect, you can then add rate-based rules to help identify potential DDoS attacks from spiking traffic. If you remember from the previous chapter, a rate-based rule counts the number of requests received from a particular IP address over a time period of 5 minutes:
By selecting a rate-based rule, you can define the maximum number of requests from a single IP within a 5-minute time frame (this must be over 2,000, otherwise this setting falls within the boundaries of a standard rule). Once this limit is reached, all further requests are then blocked until the requests drop back below the defined threshold.
