Re: Carpet bombing, what's it look like now

Saku Ytti via NANOG <[email protected]> Sat, 1 Aug 2026 16:03:36 +0300
Newsgroups gmane.org.operators.nanog
Message-ID <CAAeewD8R1qh6ay7778UmoGsKtUYFkVnXJ6Qv8Ga7smAG_99pzA@mail.gmail.com>
On Sat, 1 Aug 2026 at 15:47, Gustavo Santos <[email protected]> wrote:

> You may use sampled port mirroring for fast attack detection. It works pretty well for very short burst attacks.

If I don't sample, my cost becomes prohibitive.
If I do sample, my probability of detecting attack goes down.

The sampled port-mirroring is very much the same proposal as Vincent's IE 315.
-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/L2PVMRQL4HQPETA37627ZBGTT24UDXOQ/