Identifying DoS-attacked IP address(es)

Mon Dec 16 15:20:44 UTC 2002

Check out the following:

ftp://ftp-eng.cisco.com/cons/isp/security/

> -----Original Message-----
> From: owner-nanog at merit.edu [mailto:owner-nanog at merit.edu] On Behalf
Of
> Andre Chapuis
> Sent: Monday, December 16, 2002 6:12 AM
> To: nanog at nanog.org
> Subject: Identifying DoS-attacked IP address(es)
> 
> 
> Hi,
> How do you identify a DoS-attacked IP address(es) on your ingress
border
> router, assuming the latter is a Cisco 12000 ? I used to use ip
accounting
> but they removed it from the S-code.
> Thanks,
> André
> 
> 
> ---------------------
> Andre Chapuis
> IP+ Engineering
> Swisscom Ltd
> Genfergasse 14
> 3050 Bern
> +41 31 893 89 61
> chapuis at ip-plus.net
> CCIE #6023
> ----------------------