[c-nsp] NTP DDoS

[Dobbins, Roland]

On Feb 18, 2014, at 2:15 PM, Aaron <aaron1 at gvtc.com> wrote:

> Usually nfsen seems to be pretty accurate, is there a reason for that ~40 gbps reading during that ntp attack ?

Have you set your active flow timer to 60s/1m, so as to avoid backlogged spikes?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton