[54179] in North American Network Operators' Group
RE: Identifying DoS-attacked IP address(es)
daemon@ATHENA.MIT.EDU (Barry Raveendran Greene)
Mon Dec 16 10:21:42 2002
Reply-To: <bgreene@cisco.com>
From: "Barry Raveendran Greene" <bgreene@cisco.com>
To: "'Andre Chapuis'" <chapuis@ip-plus.net>, <nanog@nanog.org>
Date: Mon, 16 Dec 2002 07:20:44 -0800
In-Reply-To: <5.1.1.6.2.20021216151023.06097b80@imap.ip-plus.net>
Errors-To: owner-nanog-outgoing@merit.edu
Check out the following:
ftp://ftp-eng.cisco.com/cons/isp/security/
> -----Original Message-----
> From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf
Of
> Andre Chapuis
> Sent: Monday, December 16, 2002 6:12 AM
> To: nanog@nanog.org
> Subject: Identifying DoS-attacked IP address(es)
>=20
>=20
> Hi,
> How do you identify a DoS-attacked IP address(es) on your ingress
border
> router, assuming the latter is a Cisco 12000 ? I used to use ip
accounting
> but they removed it from the S-code.
> Thanks,
> Andr=E9
>=20
>=20
> ---------------------
> Andre Chapuis
> IP+ Engineering
> Swisscom Ltd
> Genfergasse 14
> 3050 Bern
> +41 31 893 89 61
> chapuis@ip-plus.net
> CCIE #6023
> ----------------------
