Re: [pmacct-discussion] Get TCP SYN totals per IP

2017-10-23 Thread Vaggelis Koutroumpas
Hello Paolo, Thanks for your reply. I actually figured it out a little after I posted this! I used libpcap with pmacctd on a capture box already doing packet capture for FastNetMon among other things. It worked like a charm :) Thanks! On 22/10/2017 3:44 μμ, Paolo Lucente wrote: > Hi Vaggelis,

Re: [pmacct-discussion] Get TCP SYN totals per IP

2017-10-22 Thread Paolo Lucente
Hi Vaggelis, Which capturing method are you using, libpcap or NetFlow/IPFIX/sFlow? And also are you looking for a dedicated solution for this or this is going to be yet another activity for an existing pmacct deployment? Taking the simplest scenario: you using libpcap, so pmacctd, and want to bu

[pmacct-discussion] Get TCP SYN totals per IP

2017-10-18 Thread Vaggelis Koutroumpas
Hello, Is it possible to get a per IP total of SYN packets? I am trying to implement some policies to block SYN packets if they exceed a certain threshold (to mitigate SYN Floods), but before doing that I want to first log all TCP SYN traffic for some time so that I can get some useful stats out