Tempesta Webshield

The current version of WebShield is experimental and should not be used in production.

Tempesta provides extended information about user requests. In this case, we’re interested in the user’s IP address, as well as their TFt and TFh hashes. These hashes allow us to distinguish users based on similar characteristics, such as TLS connection or HTTP request fingerprints.

Additionally, access logs can be stored in ClickHouse, which offers extremely powerful capabilities for analyzing traffic.

The WebShield connects to the ClickHouse database and, at regular intervals, analyzes user traffic. It compares aggregated values (such as the total number of requests, accumulated response time, and total number of error responses) against predefined thresholds. All of these thresholds can be customized in the application configuration.

To block a user, the WebShield adds the user’s TF hashes to the Tempesta FW configuration and reloads the server.