This is better identified via average packet size, I think. During a DDoS the average packet size plummets, so you don't need to keep track of historical pps rates.

On 30/03/2016 16:53:42, Stephen Fulton <sf@lists.esoteric.ca> wrote:

Hi all,

Is there a way to generate an alert when an interface has a significant
increase of packets per second, compared to a previous recorded amount?
Is there a way to compare deltas? I'm looking to identify interfaces
which may be experience a DoS situation.

Thanks,

-- Stephen
_______________________________________________
observium mailing list
observium@observium.org
http://postman.memetic.org/cgi-bin/mailman/listinfo/observium