Identifying DoS-attacked IP address(es)
Christopher L. Morrow
chris at UU.NET
Mon Dec 16 19:02:10 UTC 2002
On Mon, 16 Dec 2002, Neil J. McRae wrote:
> Sampled netflow, or look at the traceback stuff in later
> IOS 12.0S versions. Avoid filter lists as the GSR engine cards
> have a statically limited number of entries.
if something is being attacked it'll show in the 'statically limited'
listing, trust me... this is how we do it all day, every day...
More information about the NANOG