HTTP/2 DoS mitigation

Last published : Sep 22, 2026
The HTTP/2 Denial-of-Service (DoS) attacks no longer have any impact on a NetScaler appliance. If the appliance receives frames more than the maximum limit, the appliance silently closes the connection.
To mitigate attacks, the HTTP profile enables you to change the default configuration of frames received in an HTTP/2 connection.
The HTTP/2 DoS mitigation table shows the list of HTTP/2 DoS attacks and its mitigation.
Related information

Configure the maximum limit for HTTP/2 frames to mitigate DoS attacks by using the command-line interface

At the command prompt, type the following:
set ns httpprofile <profile_name> -http2MaxEmptyFramesPerMin <positive_integer> -http2MaxPingFramesPerMin <positive_integer> -http2MaxSettingsFramesPerMin <positive_integer> -http2MaxResetFramesPerMin <positive_integer> -http2MaxRxResetFramesPerMin <positive_integer> -http2SmallWndTimeout <integer>
Example:
set ns httpprofile profile1 -http2MaxEmptyFramesPerMin 20 -http2MaxPingFramesPerMin 20 -http2MaxSettingsFramesPerMin 20 -http2MaxResetFramesPerMin 20 -http2MaxRxResetFramesPerMin 100 -http2SmallWndTimeout 30

Configure the maximum limit for frames received in an HTTP/2 connection by using the NetScaler GUI

Follow these steps to configure the maximum limit for frames received in an HTTP/2 connection:
  1. On the navigation pane, expand System and then click Profiles.
  2. On the Profile page, select the HTTP Profiles tab.
  3. In the HTTP Profiles tab page, click Add.
  4. In the Configure HTTP Profile page, set the following parameters.
    1. http2MaxPingFramesPerMin: Set the maximum PING frames received per connection in a minute. If the number of PING frames exceeds the configured limit, NetScaler drops packets on the connection.
    2. http2MaxSettingsFramesPerMin: Set the maximum SETTINGS frames received per connection in a minute. If the number of SETTINGS frames exceeds the configured limit, NetScaler drops packets on the connection.
    3. http2MaxResetFramesPerMin: Set the maximum RESET frames sent per connection in a minute. If the number of RESET frames exceeds the configured limit, NetScaler drops packets on the connection.
    4. http2MaxEmptyFramesPerMin: Set the maximum empty frames sent per connection in a minute. If the number of empty frames exceeds the configured limit, NetScaler drops packets on the connection.
    5. http2MaxRxResetFramesPerMin: Set the maximum RESET frames received per connection in a minute. If the number of RESET frames exceeds the configured limit, NetScaler drops packets on the connection.
    6. http2SmallWndTimeout: Set the timeout, in seconds, for which an HTTP/2 stream can remain stalled at a zero or a small flow-control window before NetScaler silently closes the connection. The stall timer resets when the client acknowledges a meaningful amount of data, so genuinely slow clients are not affected. Set the value to 0 to disable this check.
  5. Click OK and Close.
    HTTP/2 DoS mitigation GUI configuration