[AusNOG] DDOS mitigation

[Dobbins, Roland]

On May 10, 2013, at 7:51 PM, James Braunegg wrote:

>  Have you had enough capacity to be able to absorb attacks thus collect metrics or have the attacks been larger than your capacity and hence requiring the need for S/RTBH thus losing the ability to measure the true size of the attack ?

S/RTBH doesn't in and of itself take away one's visibility into traffic on platforms with decent flow telemetry support - dropped traffic is still tabulated, with the destination ifindex set to 0.

Notable exceptions are pre-Sup2T Cisco 6500s/7600s, & pre-Sup7 Cisco 4500s.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton