Is current DDoS detecting method effective?

Kim Onnel karim.adel at
Mon Mar 7 11:43:29 UTC 2005

On Mon, 07 Mar 2005 06:11:35 +0000 (GMT), Christopher L. Morrow
<christopher.morrow at> wrote:

> Some of your cflowd gathering should also see these things, but they will
> need data correlation, something Arbor already went to the trouble of
> doing for you... So, define: "attack" and then see if your tool fits that
> definition.

So I can safely say that Detecting DDoS attacks is mostly done using
Netflow data, now the only tool(known) on the market to analyze for
attacks is Arbor, now besides being expensive, which is a problem for
Mid-sizes ISPs, doing that with open-source tools(cflowd,...) isnt
quite easy for a network engineer, who rarely has programming
experience, thats my problem now, we either need to outsource or buy

I've seen open-source Netflow DDoS specific apps. anyone tried them
(Zazu and Panoptis)

-With the small experience i've gained to work out these tools,
- Zazu is still under devel. but some times reports nice results
- couldnt compile panoptis

Any luck with (stager, Silktools, ntop,...)?

I wish there could be a documented ISPs experience for using
open-source tools to detect DDoS, or a homegrown script that uses
flow-tools to report anomalies.

Any news of undergoing projects or papers for the above, there are too
many on Blackholing, but not how to get the IP to blackhole)


More information about the NANOG mailing list