On 2/26/2014, 7:48 PM, "Dobbins, Roland" <[email protected]> wrote:
> >On Feb 27, 2014, at 6:41 AM, Thomas St-Pierre <[email protected]> wrote: > >> Normal traffic shouldn¹t be affected, > >It will be crowded out during an attack. I can live with this :) If ntp is down for a bit the servers will continue living. Their clocks shouldn¹t drift that much between the time the DDOS starts and when we¹ve null-routed the ip (using remotely triggered null-routes for our upstreams as well :) ) > >I don't know if you've the ability to match on packet size or not in >hardware for QoS - if so, UDP/123 packets which *aren't* 76 bytes in >length is a good classifier, as it leaves timesync ntp traffic alone and >squelches everything else. I admit I didn¹t check the 7600 platform, but the 6500 doesn¹t seem to support it. I can create the config, but when I apply it to the interface it says that the interface doesn¹t support matching on length :( Thanks! > >----------------------------------------------------------------------- >Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> > > Luck is the residue of opportunity and design. > > -- John Milton > > >_______________________________________________ >cisco-nsp mailing list [email protected] >https://puck.nether.net/mailman/listinfo/cisco-nsp >archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
