Re: DDOS, IDS, RTBH, and Rate limiting

2014-11-22 Thread Avi Freedman
On the contrary - SPAN nee port mirroring cuts into the frames-per-second budget of linecards, as the traffic is in essence being duplicated. It is not 'free', and it has a profound impact on the the switch's data-plane traffic forwarding capacity. Unlike NetFlow. In hosting case

Re: DDOS, IDS, RTBH, and Rate limiting

2014-11-22 Thread Avi Freedman
Cisco ASRs and MXs with inline jflow can do hundreds of K flows/second without affecting packet forwarding. Yes, i agree,those are good for netflow, but when they already exist in network. Does it worth to buy ASR, if L3 switch already doing the job (BGP/ACL/rate-limit/routing)? Not

Re: DDOS, IDS, RTBH, and Rate limiting

2014-11-22 Thread Denys Fedoryshchenko
On 2014-11-22 18:00, freed...@freedman.net wrote: Cisco ASRs and MXs with inline jflow can do hundreds of K flows/second without affecting packet forwarding. Yes, i agree,those are good for netflow, but when they already exist in network. Does it worth to buy ASR, if L3 switch already

Re: DDOS, IDS, RTBH, and Rate limiting

2014-11-22 Thread Brian Rak
On 11/22/2014 11:18 AM, Denys Fedoryshchenko wrote: On 2014-11-22 18:00, freed...@freedman.net wrote: We see a lot of Brocade for switching in hosting providers, which makes sFlow easy, of course. Oh, Brocade, recent experience with ServerIron taught me new lesson, that i can't do bonding on

Re: Outbound traffic on a circuit?

2014-11-22 Thread joel jaeggli
On 11/21/14 11:42 AM, Justin Wilson wrote: But I am buying 1 Gig on a 1 Gig circuit. I could see if it were burstable but it was being billed as 1Gig on a Gig circuit. If you're buying 1Gig commit then you're buying 1gig commit. That's not the contract you described. Justin -- Justin