I think "rate limiting" is used as an indicator of malicious intent rather than in the QoS sense. If we classify traffic as malicious we drop it. The single SY

I think "rate limiting" is used as an indicator of malicious intent rather than in the QoS sense. If we classify traffic as malicious we drop it. The single SYN will fail the 3WHS test, so we would drop it. For DNS we can usually fingerprint the attacker and block traffic. Because we are a full proxy we can do packet inspection as well. ;) There's a fair amount of intelligence already built into our products which we of course make use of (BIG-IP LTM/AFM/ASM, "IP Intelligence"). Eventually it may well come down to the SOC monitoring and adjusting the filters in real time as required - that's life.