1 Aug
2026
1 Aug
'26
1:03 p.m.
On Sat, 1 Aug 2026 at 15:47, Gustavo Santos <gustkiller@gmail.com> wrote:
You may use sampled port mirroring for fast attack detection. It works pretty well for very short burst attacks.
If I don't sample, my cost becomes prohibitive. If I do sample, my probability of detecting attack goes down. The sampled port-mirroring is very much the same proposal as Vincent's IE 315. -- ++ytti