Hi Adam,
In our case that is not useful. There is a very specific condition I'm tracking and it only occurs during a sudden increase of packets. I mentioned a DoS situation in general terms, as it causes a technical denial of service, but it is not an attack. Packet sizing did not change.
-- Stephen
On 2016-03-31 7:16 AM, Adam Armstrong wrote:
This is better identified via average packet size, I think. During a DDoS the average packet size plummets, so you don't need to keep track of historical pps rates.
adam.
On 30/03/2016 16:53:42, Stephen Fulton sf@lists.esoteric.ca wrote:
Hi all,
Is there a way to generate an alert when an interface has a significant increase of packets per second, compared to a previous recorded amount? Is there a way to compare deltas? I'm looking to identify interfaces which may be experience a DoS situation.
Thanks,
-- Stephen _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium
observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium