[54184] in North American Network Operators' Group
Re: Identifying DoS-attacked IP address(es)
daemon@ATHENA.MIT.EDU (Christopher L. Morrow)
Mon Dec 16 14:05:52 2002
Date: Mon, 16 Dec 2002 19:02:10 +0000 (GMT)
From: "Christopher L. Morrow" <chris@UU.NET>
To: "Neil J. McRae" <neil@DOMINO.ORG>
Cc: Andre Chapuis <chapuis@ip-plus.net>,
"Christopher L. Morrow" <chris@UU.NET>, <nanog@nanog.org>
In-Reply-To: <20021216173814.9AA94398C2@equinox.DOMINO.ORG>
Errors-To: owner-nanog-outgoing@merit.edu
On Mon, 16 Dec 2002, Neil J. McRae wrote:
> Sampled netflow, or look at the traceback stuff in later
> IOS 12.0S versions. Avoid filter lists as the GSR engine cards
> have a statically limited number of entries.
>
if something is being attacked it'll show in the 'statically limited'
listing, trust me... this is how we do it all day, every day...
