1 Aug
2026
1 Aug
'26
7:05 a.m.
On 2026-08-01 08:17, Saku Ytti via NANOG wrote:
What are you feeding detection with, and does it keep up? sFlow, IPFIX, IPFIX. But sampling rate is making things tricky, as very short term attacks are a thing.
IPFIX IE 315 fixes this. It also makes it easier to grab any field from the sampled packet headers. The support is still quite young and unfortunately, most vendors leave out any other IEs that could still be useful, like ForwardingStatus or routing-related IEs. This is being fixed for both Juniper and Cisco.