--- Begin Message ---
Hi John,
Thank you for sharing,
As far As I understood the solution is like this, Please correct me if I am
wrong,
1. Fastmon need to be installed to detect the DDOS and perform actions.
2. Although, there are multiple methods, I am trying to mirror the traffic
to the Fastmon.
3. Fastmon upon detecting the attack perform a predefined actions, And i
have seen in youtube, it can perform ACL.
4. if ACL is possible, then, I am thinking if possible to apply a customer
ACL based on Dst and src on the router to block only the attack flow.
Kindly let me know if above is correct, and can you help me to clarify the
following,
1. Can fastmon handle mirror traffic of 20Gbps ? I couldnt find anywhere
sizing parameter, how many cpu per Gbps.
2. Can the edge router actually apply this ACL staggered by Fastmon ? what
router support this.
Thank you and appreciate your support,
Best Regards
On 4 November 2016 at 11:39, John Gitau <[email protected]> wrote:
> If you're on the cheap you could try
> https://fastnetmon.com/
> https://github.com/pavel-odintsov/fastnetmon (source code and what not
> for the brave). I have used it in cases where a client cant afford arbor
> et'all and doesnt want to just drop the traffic.
>
> JG
>
>
> On Fri, Nov 4, 2016 at 10:50 AM, Mark Tinka <[email protected]> wrote:
>
>>
>>
>> On 4/Nov/16 09:46, Samir Abid Al-mahdi wrote:
>>
>> > Hi,
>> >
>> > Ok, but how are they going to redirect my traffic to their system.
>> >
>> > I dont have a domain to redirect it by DNS.
>> >
>> > Does it mean they will BGP advertise my prefixes ? ?
>>
>> You'd have to discuss that with them, but at the most basic level, an
>> Arbor system can automatically begin announcing a route into BGP that
>> needs to have its traffic scrubbed once an attack is detected.
>>
>> Matching can be high-level (ASN) or granular (IP address).
>>
>> I suppose other systems have a similar mechanism, but I haven't used
>> those.
>>
>> Mark.
>>
>> _______________________________________________
>> cisco-nsp mailing list [email protected]
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>
>
>
> --
> **Gitau
>
--- End Message ---
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
