From: ASHISH <ashishis@gmail.com>
To: netfilter@lists.netfilter.org
Subject: Re: UDP packet storm
Date: Tue, 28 Dec 2004 02:08:08 +0530 [thread overview]
Message-ID: <558224e304122712386be36d59@mail.gmail.com> (raw)
In-Reply-To: <558224e304122712367f38de5d@mail.gmail.com>
I would suggest the following method:-
1. Go through the network activity logs, and estimate the average no
of packets per unit time that you consider as normal to your packet.
2. Then think of a tolerance margin.
3. Write appropriate rules for limting the rate of packets.
I would recommend genarating a cron job that estimates the average
number of packets per unit time after every day, and update the rule
in filter table. Again optimal estimation is not a trivial job as it
depends on several factors.
On Mon, 27 Dec 2004 17:40:26 -0200, Bruno Wallace
<bruno.wallace@gmail.com> wrote:
> hello everybody,
> what rule is implemented to udp packet storm?
> --
> thanks,
> Bruno Wallace
>
>
--
cheers
Ashish
--
cheers
Ashish
next prev parent reply other threads:[~2004-12-27 20:38 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-12-27 19:40 UDP packet storm Bruno Wallace
[not found] ` <558224e304122712367f38de5d@mail.gmail.com>
2004-12-27 20:38 ` ASHISH [this message]
2004-12-28 22:43 ` Jose Maria Lopez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=558224e304122712386be36d59@mail.gmail.com \
--to=ashishis@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.