On Fri, Mar 28, 2014 at 03:31:49PM PDT, Luke S. Crawford spake thusly: > Would that give me data to the resolution I need to detect sub-second floods > of traffic? My initial impression is that it would not... but as I have > yet to set it up, I don't know.
I use sflow for this purpose. You set a packet-sampling rate. So it depends on how many packets long your burst is. I currently sample every thousand packets which works well for me. I then feed it into logstash/Kibana for analysis. -- Tracy Reed
pgpcq6T4IID5j.pgp
Description: PGP signature
_______________________________________________ Tech mailing list Tech@lists.lopsa.org https://lists.lopsa.org/cgi-bin/mailman/listinfo/tech This list provided by the League of Professional System Administrators http://lopsa.org/
