At a glance
- Did you know
- Bot managers score clients by behaviour and fingerprint, not by IP address alone.
- Rule of thumb
- Challenge suspicious clients instead of blocking them, to spare real users.
- Watch out
- Bots scrape or stuff credentials; challenges annoy real users.
Its settings in ScaleMySystems
What you can change on it in the lab, and what each number does.
- Concurrency (slots)
- Calls it can work on at once (per instance when autoscaling). Needed slots ≈ calls per second × seconds each takes. Extra calls wait in the queue, then are rejected.
- Queue capacity
- Calls allowed to wait for a free slot. A bigger queue absorbs bursts but adds waiting time; 0 rejects straight away.
- Latency (p50) (ms)
- Typical time one call takes here, before any calls it makes itself. Slots are held for this long.
- Latency (p99) (ms)
- The slowest 1% of calls. Callers must set their timeout above this or they cut off healthy calls.
- Attack block rate
- Share of the attacks it covers that it stops. The rest pass through and are served like real users.
- False positives (real users blocked)
- Share of real users it wrongly blocks. Stricter rules raise the block rate and this together.
Problems that start with it
- The WAF blocks real users A strict WAF rule set blocks 4% of real users as attackers.
- ChatGPT: from launch build to real traffic A chat product on launch-week hardware: the GPU prefill and decode pools, the KV cache store, moderation and the chat API are an eighth of the size real traffic needs. 300 chats a second arrive with long prompts. Answers queue for 20 seconds and most fail.
Full lesson coming soon
Lessons are being added one component at a time: how it works, its settings, a live exercise to break and fix it, interview questions and a short check. See the Circuit breaker lesson for what one looks like.