[c-nsp] NDE Sup720-3BXL and 3CXL with Andrisoft WanGuard

[Dumitru Ciobarcianu]

On 27-Jan-15 18:12 PM, John Brown wrote:
> Can the 65xx with SUP720-3BXL or 3CXL support netflow rates that are
> not sampled rates ??
> At present we are doing a sample rate of 1024, and I'm wondering if we
> can reduce that to get finer resolution and if that will  a)
> negatively impact the box, b) really get us anything...
> The box is used for routing and managing BGP transit / peering connections.
> 
> Any experience with Andrisoft Wanguard product, good bad ugly, support issues ??
> If any one has sample configs, i'm interested in that as well

Hi,

In my experience, any DDoS detector which is netflow-based will not be
fast enough or accurate enough with an SUP720. At least for us, it wasn't.

We ended up using port mirroring and running detection on that.

YMMW.


Dumitru.