Re: Carpet bombing, what's it look like now
Vincent Bernat via NANOG <[email protected]> Sat, 1 Aug 2026 09:05:16 +0200
| Newsgroups | gmane.org.operators.nanog |
|---|---|
| Message-ID | <[email protected]> |
On 2026-08-01 08:17, Saku Ytti via NANOG wrote: >> What are you feeding detection with, and does it keep up? sFlow, IPFIX, > IPFIX. But sampling rate is making things tricky, as very short term > attacks are a thing. IPFIX IE 315 fixes this. It also makes it easier to grab any field from the sampled packet headers. The support is still quite young and unfortunately, most vendors leave out any other IEs that could still be useful, like ForwardingStatus or routing-related IEs. This is being fixed for both Juniper and Cisco. _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/[email protected]/message/CVYXNPL5ZWOSKDZZYHUPOVNJEY4MZCEC/