Subject: RE: [Flow-tools] Strange Router Export Issue
Greg.Volk@edwardjones.com
Date: Thu May 19 2005 - 12:54:27 CDT
> >I’ve got a strange issue that is just perplexing me. Basically >here’s my setup: > >I’ve got two 7513’s and one 7206. Each has one internet DS-3. The >7513’s also support other customer connections, but the 7206 is just >the DS-3. > >Starting a couple of days ago, the 7206 started sending HUGE numbers >(10x normal) of flows to my flow-collector. I’ve dug into the raw >flow files and I just don’t see anything strange. All three routers >carry about the same traffic load according to bandwidth, but the >flows are out of the ball park for the 7206. It’s almost like the >router is counting traffic multiple times, but the config didn’t >change when this started. > > >Anyone have any ideas on where I should look? > This sounds like a ddos attack to me. I've been hit with a ddos before on my internet router which happens to be a 7206VXR with a full DS3 attached to it. It added about 20% onto the router's CPU utilization and drove up the number of flows by at least 10x. The additional flows caused my flow-capture/flowscan system to fall behind to the point that I had to kill flow-capture until the ddos was over. -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Thu May 19 2005 - 12:59:15 CDT