|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Ping flooding (fwd)
In message <[email protected]>, Per Gregers Bilse writes: > > Yes ... but you shouldn't need anything special for that. We have > been doing the same for a long time, using regular IP accounting on > the edge routers, which is then summarised over a full routing table. > The only discrepancies that occur are if changes in routing occur > between the time of accounting and processing, but this tends not to > be a problem. What if the edge router is sitting at MaeEast or some other very busy edge of your network. Knowing traffic patterns to/from the interconnects is very useful for traffic engineering and neccesary if the "attack" you want to trace back goes through an interconnect. I may be wrong, but I was under the impression that flow switching wasn't up for this and regular IP accounting is completely useless in this particular case. Curtis - - - - - - - - - - - - - - - - -
|