On Mon, 07 Mar 2005 06:11:35 +0000 (GMT), Christopher L. Morrow <christopher.morrow@mci.com> wrote:
Some of your cflowd gathering should also see these things, but they will need data correlation, something Arbor already went to the trouble of doing for you... So, define: "attack" and then see if your tool fits that definition.
So I can safely say that Detecting DDoS attacks is mostly done using Netflow data, now the only tool(known) on the market to analyze for attacks is Arbor, now besides being expensive, which is a problem for Mid-sizes ISPs, doing that with open-source tools(cflowd,...) isnt quite easy for a network engineer, who rarely has programming experience, thats my problem now, we either need to outsource or buy Arbor, I've seen open-source Netflow DDoS specific apps. anyone tried them (Zazu and Panoptis) -With the small experience i've gained to work out these tools, - Zazu is still under devel. but some times reports nice results - couldnt compile panoptis Any luck with (stager, Silktools, ntop,...)? I wish there could be a documented ISPs experience for using open-source tools to detect DDoS, or a homegrown script that uses flow-tools to report anomalies. Any news of undergoing projects or papers for the above, there are too many on Blackholing, but not how to get the IP to blackhole) Regards