MMP - BadGuys Badness Is Reinitialized If IP Is Disconnected And Connected To A New Process (Doc ID 2573630.1)

Last updated on MARCH 31, 2022

Applies to:

Symptoms

BadGuys has been configured on an MMP. During testing, it was found that if the connection is terminated (regardless of whether it is terminated gracefully or not), the badness for the suspected IP resets to 1.

Here's an example of two connections from the same IP:

As you can see, the connection has a new ID and the badness is initialized to 1 for the same IP address.
Due to this issue, it is difficult to track and fight DDOS or password harvesting attacks.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.