[nsp] Observation using Modular QOS to mitigate Nachi

[Dmitri Kalintsev]

On Tue, Oct 14, 2003 at 10:36:30PM -0400, Brian Apley wrote:

[snip]

> Here's the funny part- no matter how many times the counters are cleared,
> or how many packets increment, it's always 120. Since the 92 includes the
> header, who wants to take a stab at where the other 28 bytes are coming
> from?

Cisco's SNMP counters traditionally include L2 overhead (which is not
included in the "packet length" in your sense). My guess would be that these
are the bytes of 802.3/802.1q and reminder having something do with the BVI
encapsulation (whatever it happens to be). No hard data, just a speculation
here. ;)

Good page to make your head spin (in the right direction?):

http://www.cisco.com/warp/public/105/encheat.html

SY,
-- 
D.K.