[54185] in North American Network Operators' Group
Re: Identifying DoS-attacked IP address(es)
daemon@ATHENA.MIT.EDU (Neil J. McRae)
Mon Dec 16 14:43:03 2002
In-Reply-To: <Pine.GSO.4.33.0212161901110.22551-100000@rampart.argfrp.us.uu.net>
"from Christopher L. Morrow at Dec 16, 2002 07:02:10 pm"
To: "Christopher L. Morrow" <chris@UU.NET>
Date: Mon, 16 Dec 2002 19:20:05 +0000 (GMT)
Cc: "Neil J. McRae" <neil@DOMINO.ORG>,
Andre Chapuis <chapuis@ip-plus.net>, nanog@nanog.org
From: neil@DOMINO.ORG (Neil J. McRae)
Errors-To: owner-nanog-outgoing@merit.edu
> if something is being attacked it'll show in the 'statically limited'
> listing, trust me... this is how we do it all day, every day...
Yes as have we, however you run out of memory/list entries
quickly and when that happens CEF gets disabled and it get pretty ugly.
This is more an issue for engine 0 and 2
--
Neil J. McRae - Alive and Kicking
neil@DOMINO.ORG
