Re: Carpet bombing, what's it look like now

[Vincent Bernat via NANOG <nanog () lists nanog org>]

On 2026-08-01 08:17, Saku Ytti via NANOG wrote:
> > What are you feeding detection with, and does it keep up? sFlow, IPFIX,
> IPFIX. But sampling rate is making things tricky, as very short term
> attacks are a thing.

IPFIX IE 315 fixes this. It also makes it easier to grab any field from 
the sampled packet headers. The support is still quite young and 
unfortunately, most vendors leave out any other IEs that could still be 
useful, like ForwardingStatus or routing-related IEs. This is being 
fixed for both Juniper and Cisco.
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/CVYXNPL5ZWOSKDZZYHUPOVNJEY4MZCEC/