[c-nsp] NTP DDoS

Dobbins, Roland rdobbins at arbor.net
Tue Feb 18 04:20:16 EST 2014

On Feb 18, 2014, at 2:15 PM, Aaron <aaron1 at gvtc.com> wrote:

> Usually nfsen seems to be pretty accurate, is there a reason for that ~40 gbps reading during that ntp attack ?

Have you set your active flow timer to 60s/1m, so as to avoid backlogged spikes?

Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton

More information about the cisco-nsp mailing list