> >I�ve got a strange issue that is just perplexing me. Basically >here�s my setup: > >I�ve got two 7513�s and one 7206. Each has one internet DS-3. The >7513�s also support other customer connections, but the 7206 is just >the DS-3. > >Starting a couple of days ago, the 7206 started sending HUGE numbers >(10x normal) of flows to my flow-collector. I�ve dug into the raw >flow files and I just don�t see anything strange. All three routers >carry about the same traffic load according to bandwidth, but the >flows are out of the ball park for the 7206. It�s almost like the >router is counting traffic multiple times, but the config didn�t >change when this started. > > >Anyone have any ideas on where I should look? >
This sounds like a ddos attack to me. I've been hit with a ddos before on my internet router which happens to be a 7206VXR with a full DS3 attached to it. It added about 20% onto the router's CPU utilization and drove up the number of flows by at least 10x. The additional flows caused my flow-capture/flowscan system to fall behind to the point that I had to kill flow-capture until the ddos was over. _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
