Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Why do you use Netflow

  • From: Jack Bates
  • Date: Tue Aug 19 17:26:03 2003

Jason Frisvold wrote:

We used ip accounting the other night to detect and disable a large
number of worm infected users that took out the router completely..  I
think net flow would have been too much overhead at the time...  Once we
were down to a more manageable number of infected users, we used netflow
to pinpoint them immediately...  (Note, we don't leave netflow on all
the time)
One method for limiting netflow accounting to manageable ammounts is to access-list the port involved. This is why I did institute 135 blocking. This flags the flow as inactive which only holds it for like 15 seconds on default. Of course, this still may not be enough for some routers. I just happen to have prepared for this actual event due to constant DDOS attacks about nine months ago (reverse view, change rule matches).

-Jack





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.