RE: Identifying DoS-attacked IP address(es)

Check out the following: ftp://ftp-eng.cisco.com/cons/isp/security/

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Andre Chapuis Sent: Monday, December 16, 2002 6:12 AM To: nanog@nanog.org Subject: Identifying DoS-attacked IP address(es)

Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André

--------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis@ip-plus.net CCIE #6023 ----------------------