> Hmm, I noticed when I looked in the netflow for the attack traffic that there > were more than 400,000 source IPs participating in the attack, they were > obviously spoofed/what-have-you, but would that make a difference? I don't > think I've ever seen one with that many sources before, bravo to them for > going the extra mile... > > -Drew
Wow, that's impressive! If each of those was associated with a unique MAC address somehow, your CAM table surely was overloaded, which would explain the unicast flooding. If it happens again, take a look at your CAM table to see if it's full. John _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
