[60901] in North American Network Operators' Group
Re: Why do you use Netflow
daemon@ATHENA.MIT.EDU (Paul A. Bradford)
Tue Aug 19 16:36:09 2003
From: "Paul A. Bradford" <paul.bradford@adelphia.com>
Reply-To: paul.bradford@adelphia.com
To: nanog@merit.edu
In-Reply-To: <FC0B9DA2600ED4118F76009027AA5DDD0537DDC6@ALEX2>
Date: 19 Aug 2003 16:16:47 -0400
Errors-To: owner-nanog-outgoing@merit.edu
Well,
On ciscos, we use it to track down DOS attacks in a put it on,
troubleshoot, take it off manner. Works great on not Catalyst stuff...
put it on.. wait 30 seconds look for anything with K packets and you've
got your bad guy, hopefully.
Thanks,
Paul
On Tue, 2003-08-19 at 15:55, lance_tatman@agilent.com wrote:
> Are operators frequently using netflow nowadays? I assume that if you are, you turn it on only for
> some limited duration to collect your data and then go back and do your analysis. Is this assumption correct?
>
> What are you looking at when you analyze this data? I've seen uses such as
> top 10 destination AS's for peering evaluations. What else? Billing?
>
> -Lance-
>
>
>
>
--
Paul A Bradford
Senior Network Engineer
Adelphia Cable Communications
814-274-6663
