I would have thought that the DDoS that you've described is relatively
easy to block, so more sophisticated ones will spray an entire subnet,
with the source coming from random IP addresses, and with random src/dst
ports. Unless things have changed in the last couple of years, there
isn't much
Title: Re: [Flow-tools] Strange Router Export Issue
Check the cache size/health on the 7206. A DoS with small packets sent at high rates from random sources to random destinations will cause the cache on the 7206 to thrash resulting in a large number of new flows without a obvious shift in
