Understanding rate limiting
How does a leaky bucket algorithm work?
Leaky bucket algorithms are widely used to mitigate application attacks and deal with an application’s burstiness. The analogy uses a bucket where water is poured in at the top and leaks from the bottom; if the rate at which water is poured in exceeds the rate at which it leaks, the bucket overflows.
Regarding request processing, the water represents client requests, and the bucket represents a queue where requests wait to be processed according to a first‑in‑first‑out (FIFO) scheduling algorithm. The leaking water represents requests exiting the buffer for processing by the server, and the overflow represents requests that are discarded and never serviced.
A mitigation rule is automatically created for the source IPs generating ‘Rejected’ events. These rules are installed on our Threat Protection mitigation platform and become active until the attack stops. Sometimes, the system may choose to keep the rules active after the attack stops. Any blocked connection attempts from these Source IPs can be viewed in the Threat Protection Portal.