[54181] in North American Network Operators' Group
Re: Identifying DoS-attacked IP address(es)
daemon@ATHENA.MIT.EDU (Andre Chapuis)
Mon Dec 16 11:39:56 2002
Date: Mon, 16 Dec 2002 17:39:27 +0100
To: "Christopher L. Morrow" <chris@UU.NET>
From: Andre Chapuis <chapuis@ip-plus.net>
Cc: <nanog@nanog.org>
In-Reply-To: <Pine.GSO.4.33.0212161635030.22551-100000@rampart.argfrp.us
.uu.net>
Errors-To: owner-nanog-outgoing@merit.edu
Chris,
I often see the input-interface load is 100%.
Andr=E9
At 16:35 16.12.2002 +0000, Christopher L. Morrow wrote:
>On Mon, 16 Dec 2002, Andre Chapuis wrote:
>
>>
>> Hi,
>> How do you identify a DoS-attacked IP address(es) on your ingress border=
router, assuming the latter is a Cisco 12000 ? I used to use ip accounting=
but they removed it from the S-code.
>
>What info do you have when you are trying to accomplish this mission?
>
>> Thanks,
>> Andr=E9
>>
>>
>> ---------------------
>> Andre Chapuis
>> IP+ Engineering
>> Swisscom Ltd
>> Genfergasse 14
>> 3050 Bern
>> +41 31 893 89 61
>> chapuis@ip-plus.net
>> CCIE #6023
>> ----------------------
>>
---------------------
Andre Chapuis
IP+ Engineering
Swisscom Ltd
Genfergasse 14
3050 Bern
+41 31 893 89 61
chapuis@ip-plus.net
CCIE #6023
----------------------
