Identifying DoS-attacked IP address(es)
Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis@ip-plus.net CCIE #6023 ----------------------
Check out the following: ftp://ftp-eng.cisco.com/cons/isp/security/
-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Andre Chapuis Sent: Monday, December 16, 2002 6:12 AM To: nanog@nanog.org Subject: Identifying DoS-attacked IP address(es)
Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code. Thanks, André
--------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis@ip-plus.net CCIE #6023 ----------------------
On Mon, 16 Dec 2002, Andre Chapuis wrote:
Hi, How do you identify a DoS-attacked IP address(es) on your ingress border router, assuming the latter is a Cisco 12000 ? I used to use ip accounting but they removed it from the S-code.
What info do you have when you are trying to accomplish this mission?
Thanks, Andr�
--------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis@ip-plus.net CCIE #6023 ----------------------
participants (3)
-
Andre Chapuis -
Barry Raveendran Greene -
Christopher L. Morrow