nanog mailing list archives
Re: ICANN Targets DDoS Attacks
From: Jared Mauch <jared () puck Nether net>
Date: Tue, 29 Oct 2002 16:31:50 -0500
On Tue, Oct 29, 2002 at 01:24:11PM -0800, Dan Lockwood wrote:
Would anyone be willing to post an operational example of CAR for ICMP. I would like to see what others are doing to combat the problem. Dan
rate-limit input access-group 2000 1536000 200000 200000 conform-action transmit exceed-action drop access-list 2000 permit icmp any any echo access-list 2000 permit icmp any any echo-reply POS0/1 <peer interface> Input matches: access-group 2000 params: 1536000 bps, 200000 limit, 200000 extended limit conformed 96374566 packets, 19474M bytes; action: transmit exceeded 16609350 packets, 1446M bytes; action: drop last packet: 28ms ago, current burst: 0 bytes last cleared 7w5d ago, conformed 33230 bps, exceeded 2467 bps POS0/2 <peer interface> Input matches: access-group 2000 params: 1536000 bps, 200000 limit, 200000 extended limit conformed 37773899 packets, 6325M bytes; action: transmit exceeded 5222953 packets, 399165438 bytes; action: drop last packet: 52ms ago, current burst: 0 bytes last cleared 7w5d ago, conformed 10794 bps, exceeded 681 bps As you can see by looking at your 'current burst' information, you can find out if there is an active attack/exceeding. These rates are typically quite low as you can see. - Jared
Current thread:
- Re: ICANN Targets DDoS Attacks, (continued)
- Message not available
- Re: ICANN Targets DDoS Attacks Jared Mauch (Oct 29)
- Re: ICANN Targets DDoS Attacks Brett Frankenberger (Oct 29)
- Re: ICANN Targets DDoS Attacks Peter E. Fry (Oct 29)
- Re: ICANN Targets DDoS Attacks Valdis . Kletnieks (Oct 29)
- Re: ICANN Targets DDoS Attacks Jared Mauch (Oct 29)
- RE: ICANN Targets DDoS Attacks fingers (Oct 29)
- Re: ICANN Targets DDoS Attacks bob (Oct 29)
- Re: ICANN Targets DDoS Attacks Jared Mauch (Oct 29)
- Re: ICANN Targets DDoS Attacks Jared Mauch (Oct 29)
- Re: ICANN Targets DDoS Attacks Valdis . Kletnieks (Oct 30)
- Re: ICANN Targets DDoS Attacks Crist J. Clark (Oct 31)
- Provider feedback Derek Samford (Oct 31)