Re: Carpet bombing, what's it look like now

[Saku Ytti via NANOG <nanog () lists nanog org>]

On Sat, 1 Aug 2026 at 15:47, Gustavo Santos <gustkiller () gmail com> wrote:

> You may use sampled port mirroring for fast attack detection. It works pretty well for very short burst attacks.

If I don't sample, my cost becomes prohibitive.
If I do sample, my probability of detecting attack goes down.

The sampled port-mirroring is very much the same proposal as Vincent's IE 315.
-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/L2PVMRQL4HQPETA37627ZBGTT24UDXOQ/