Set up netflow at your network borders.
Send to a collector and dump 30s windows in raw v5 netflow to a file.
Dump from raw v5 to a text parsable format.
Every 2 minutes or so, use a cron to merge all flow data.
account for:
netflor variations
origin AS
watch pps rates
watch DST port to detect DDOS attacks
graph pps&bps by proto and pps by port
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment