1. Does S/RTBH require BGP right? 2. To run BGP requirement is you have to be /24 class network right? (we are very small company) 3. DDoS has many many source IP address (spoofed) It's hard to block Source when million IP attacks, right?
We are running IDS on network to detect Attack and send alerts, our attack mostly last 5 to 10min Max time and we are getting average 4 to 5G attack on 10G fiber link. On Tue, Apr 26, 2016 at 1:54 PM, Roland Dobbins <[email protected]> wrote: > On 27 Apr 2016, at 0:50, Satish Patel wrote: > >> Does cisco has config like following apply ACL base on criteria > > > Cisco has QoS. > > But you really aren't being smart about this. Why not use S/RTBH on your > edge router to simply block the sources, since they aren't spoofed? > > Export NetFlow from your edge router to an open-source collection/analysis > system, so that you can see the sources. > > But you do know that most UDP reflection/amplification attacks are > high-volume, yes? So, your transit pipe may still be filled up due to sheer > bps. > > > ----------------------------------- > Roland Dobbins <[email protected]> > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
