North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Redirecting mail (Re: Throttling mail)

  • From: Valdis.Kletnieks
  • Date: Thu Mar 25 17:49:49 2004 
On Thu, 25 Mar 2004 14:43:33 CST, Adi Linden said:

> Where is something like this documented and explained?

If your customer-facing routers/switches are able to generate flow statistics,
it's a Small Matter Of Programming to have something catch said data and do the
analysis.  You might need some semi-studly backend systems, but the basic idea
isn't any more complicated than a 'cut | sort | uniq -c | sort -nr | head'
pipeline.

As a data point,  some 200 of our boxes got nailed by Witty, and the flow data
for udp/4000 for 3/19 and 3/20 was 18GB.  Of course, since essentially each
packet ended up being a separate flow, this was a very worst case scenario (one
box alone did 3M flows in 1 hour, but it was on a 100Mbit port).  Expect much
lower numbers of flows from even the most ambitious cablemodem or DSL based
spambot. ;)

Attachment: pgp00033.pgp
Description: PGP signature