Thanks. I'm trying to slow down ddos attacks that use legitimate udp ports, do I really want to police my friendly udp traffic right along with my attack udp traffic? The line of thinking that I was running with was to merely slow down the udp traffic, not drop it completely. Basically, I'm getting ddos udp attacks in the realm of 2 and 3 gbps up to 2 hours in duration. This is killing my distribution networks feed at 1 gbps rates. I wanted to slow down (shape) udp on an on-going basis, so as to slow down the momentary udp attacks. Thoughts?
Aaron -----Original Message----- From: Lars Eidsheim [mailto:[email protected]] Sent: Wednesday, November 13, 2013 7:36 AM To: Aaron; 'Oliver Boehmer (oboehmer)'; [email protected] Subject: SV: [c-nsp] shaping > 128 mbps - asr9k Do you need to use shaping? If not you can use a policer, Example: policy-map from-internet-child class udp-attack police rate 500 mbps ! class class-default ! end-policy-map Mvh Lars Eidsheim iNTELLiT -----Opprinnelig melding----- Fra: cisco-nsp [mailto:[email protected]] På vegne av Aaron Sendt: 12. november 2013 22:00 Til: 'Oliver Boehmer (oboehmer)'; [email protected] Emne: Re: [c-nsp] shaping > 128 mbps - asr9k policy-map from-internet-child class udp-attack shape average 600 mbps ! class class-default ! end-policy-map -----Original Message----- From: Aaron [mailto:[email protected]] Sent: Tuesday, November 12, 2013 2:58 PM To: 'Oliver Boehmer (oboehmer)'; '[email protected]' Subject: RE: [c-nsp] shaping > 128 mbps - asr9k (here's the uncommitted (failing) config... basically I want to shape inbound UDP to 600 mbps. please show me how to accomplish that.) RP/0/RSP0/CPU0:eng-lab-9k-1(config-pmap-c)#show config policy-map from-internet-parent class class-default service-policy from-internet-child shape average 1 gbps ! end-policy-map ! interface GigabitEthernet0/0/0/5 service-policy input from-internet-parent ! end RP/0/RSP0/CPU0:eng-lab-9k-1(config-pmap-c)#commi % Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors RP/0/RSP0/CPU0:eng-lab-9k-1(config-pmap-c)#show config failed !! SEMANTIC ERRORS: This configuration was rejected by !! the system due to semantic errors. The individual !! errors with each failed configuration command can be !! found below. interface GigabitEthernet0/0/0/5 service-policy input from-internet-parent !!% 'prm_ezhal' detected the 'warning' condition 'Cannot support child/flat shape rate > 128Mbps' ! end RP/0/RSP0/CPU0:eng-lab-9k-1(config-pmap-c)#do sh run class-map class-map match-all udp-attack match protocol udp end-class-map ! -----Original Message----- From: Oliver Boehmer (oboehmer) [mailto:[email protected]] Sent: Tuesday, November 12, 2013 2:23 PM To: Aaron; [email protected] Subject: Re: [c-nsp] shaping > 128 mbps - asr9k >Anyone know how to accomplish shaping traffic at a rate greater than >128 mbps ? > >When I apply the policy-map/class-map to an interface it fails with >this message. > >'Cannot support child/flat shape rate > 128Mbps' can you please share the configuration you are trying to apply, including policy-maps and where you want to apply this? oli _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ This email has been scanned and secured by Intellit This communication is for use by the intended recipient and contains information that may be privileged, confidential and exempt from disclosure or copyrighted under applicable law. If you are not the intended recipient, you are hereby formally notified that any dissemination, use, copying or distribution of this e-mail, in whole or in part, is strictly prohibited. Please notify the sender by return e-mail and delete this e-mail from your system. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
