nanog mailing list archives
Re: Redirecting mail (Re: Throttling mail)
From: Valdis.Kletnieks () vt edu
Date: Thu, 25 Mar 2004 17:45:12 -0500
On Thu, 25 Mar 2004 14:43:33 CST, Adi Linden said:
Where is something like this documented and explained?
If your customer-facing routers/switches are able to generate flow statistics, it's a Small Matter Of Programming to have something catch said data and do the analysis. You might need some semi-studly backend systems, but the basic idea isn't any more complicated than a 'cut | sort | uniq -c | sort -nr | head' pipeline. As a data point, some 200 of our boxes got nailed by Witty, and the flow data for udp/4000 for 3/19 and 3/20 was 18GB. Of course, since essentially each packet ended up being a separate flow, this was a very worst case scenario (one box alone did 3M flows in 1 hour, but it was on a 100Mbit port). Expect much lower numbers of flows from even the most ambitious cablemodem or DSL based spambot. ;)
Attachment:
_bin
Description:
Current thread:
- Re: Redirecting mail (Re: Throttling mail), (continued)
- Re: Redirecting mail (Re: Throttling mail) Ray Burkholder (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Scott McGrath (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Valdis . Kletnieks (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Deepak Jain (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Valdis . Kletnieks (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Adi Linden (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Petri Helenius (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Adi Linden (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Valdis . Kletnieks (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Adi Linden (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) Valdis . Kletnieks (Mar 25)
- Re: Redirecting mail (Re: Throttling mail) J.D. Falk (Mar 25)