Using the DoS Data Management page, you can configure the DoS learning mode profile to restart or load from a previous profile. DoS attacks interrupt network services by flooding a system or host with spurious traffic, which can overflow your system buffers and force you to take the system offline for repairs.
Since a DoS profile can be configured for both learning and threshold modes, the Sensor keeps statistics for both modes. For learning mode, the Sensor monitors the network traffic and develops a normal baseline profile, called a long-term profile, by collecting statistics on a number of traffic measures over time. The initial learning time for the profile is typically 48 hours. After that time, the system constantly updates this profile, which is kept on the internal Sensor flash, to keep an updated picture of the network. The Sensor develops a short-term profile, which is a two minute slice of the network traffic. The short-term profile is compared to the long-term profile and an alert is raised if the short-term statistics indicates a traffic surge that deviates too much from the long-term behavior.
For threshold mode, the Sensor keeps track of the threshold limits you enabled for specific attacks. Together these two modes create one profile, which is saved to your Sensor's flash and can be uploaded to the Manager for future re-use. You can upload this saved profile later if you feel the baseline that had previously been created was more effective than a current profile.