Home page logo

nanog logo nanog mailing list archives

Re: Why do you use Netflow
From: "Paul A. Bradford" <paul.bradford () adelphia com>
Date: 19 Aug 2003 16:16:47 -0400

   On ciscos, we use it to track down DOS attacks in a put it on,
troubleshoot, take it off manner.  Works great on not Catalyst stuff... 
put it on.. wait 30 seconds look for anything with K packets and you've
got your bad guy, hopefully.


On Tue, 2003-08-19 at 15:55, lance_tatman () agilent com wrote:
Are operators frequently using netflow nowadays?  I assume that if you are, you turn it on only for
some limited duration to collect your data and then go back and do your analysis.  Is this assumption correct?

What are you looking at when you analyze this data?  I've seen uses such as
top 10 destination AS's for peering evaluations.  What else?  Billing?


Paul A Bradford
Senior Network Engineer
Adelphia Cable Communications

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]