Skip to content
Cloudflare Docs

Override expressions

Set an override expression for the Network-layer DDoS Attack Protection managed ruleset to define a specific scope for sensitivity level or action adjustments.

When considering which, if any, expressions you should utilize, think of expressions as a tool to scope overrides to the specific service that the Network-layer DDoS Attack Protection managed ruleset is protecting. That is to say that most services are defined by their destination ports and IPs as opposed to source ports or IPs. Refer to Imporant remarks for more information.

For example, you can set different sensitivity levels for different destination IP addresses or ports: a medium sensitivity level for destination IP address A and a low sensitivity level for destination IP address B.

Available expression fields

The following fields are made available for use in override expressions.

The list of fields we recommend using in expressions:

  • ip.dst
  • ip.proto.num
  • tcp.dstport
  • tcp.flags
  • tcp.flags.ack
  • tcp.flags.fin
  • tcp.flags.push
  • tcp.flags.reset
  • tcp.flags.syn
  • tcp.flags.urg
  • udp.dstport

The list of fields we do not recommend to be used in expressions:

  • ip.src
  • ip.len
  • ip.ttl
  • tcp.srcport
  • udp.srcport

Refer to the Fields reference in the Rules language documentation for more information.

Important remarks

Override expressions are not allowlists. Overrides are applied to the detection, and are not applied to the resulting mitigation. This means an override only takes effect if the attack fingerprint, as generated by the DDoS managed rules, includes the same fields specified in your expression. Thus, it makes the use of source fields like ip.src, ip.len, ip.ttl, tcp.srcport, and udp.srcport unreliable.

The use of non-recommended fields in an expression may result in unexpected behavior. While you may be inclined to utilize source properties, the expressions are not allowlists and including source traffic properties may result in false positives.

For example, if you create an override with sensitivity set to Essentially Off for ip.src eq 192.0.2.1, it only applies if the fingerprint includes ip.src. However, because DDoS attacks are often distributed across many source IPs, the fingerprint may not include ip.src at all. In such cases, your override is not applied.

In a common scenario, an attack originating from thousands of IPs can target a single destination IP and port. The fingerprint would focus on the shared attributes, such as the destination IP, port, and additional packet fields that represent strong signals of the attack pattern. Even if your override matches a specific source IP, it will not apply if that field is not present in the fingerprint. As a result, the system will mitigate the attack using the default high sensitivity, and traffic from your specified IP could still be blocked. It is recommended to use more stable expressions such as protocol, destination IP, and destination port.

Character limits

Each expression is limited to 4,000 characters, which means you can enter approximately a maximum of 200 IP addresses in a single expression. However, you can enter IP addresses in CIDR format, which allows you to include a larger number of IP addresses. For example, you can use 192.0.0.0/24 to match IP addresses from 192.0.0.0 to 192.0.0.255.