Re: [Observium] Alerts based on a sudden increase of packets per second

This is better identified via average packet size, I think. During a DDoS the average packet size plummets, so you don't need to keep track of historical pps rates.

adam. On 30/03/2016 16:53:42, Stephen Fulton sf@lists.esoteric.ca wrote: Hi all,

Is there a way to generate an alert when an interface has a significant increase of packets per second, compared to a previous recorded amount? Is there a way to compare deltas? I'm looking to identify interfaces which may be experience a DoS situation.

Thanks,

-- Stephen _______________________________________________ observium mailing list observium@observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium