Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an enterprise network system which has a router facing the internet, beneath it a virtual chassis switch, below it an access layer switch and finally a server. My question is that when there is a Ddos attack, even though i have solutions to mitigate the attack on a server level my bandwidth between the router and switches gets hogged up. I want to know

a) how can i quickly know which ports of all the devices are carrying that traffic so i can quickly shut them down b) a network mapping software which can draw the topology for me and preferably give me stats like network bandwidth being used etc.

share|improve this question

2 Answers 2

Do you expect DDoS attacks to be coming from somewhere other than the Internet? If so, wouldn't this imply that your edge router would pretty much provide the definitive source of information about traffic surges and such?

Anyhow - as far as the router is concerned, Netflow/sflow (depending on vendor in use) provides both good analytics about the source, destination and type of traffic in use as well as packets per second, overall volume, AS information, etc. There are commercial tools that specialize in DDoS detection from this information (i.e. the Arbor products) as well as a wide variety of open source options that can be set up (in conjunction with appropriate packages) to alarm when certain thresholds are reached, etc. The added benefit here is also that the information can provide historical records of when attacks began, ended, etc. There's also obviously the other major benefit of being able to provide tons of information for capacity planning, traffic engineering, etc.

share|improve this answer

Most competent Monitoring suites can do this. Anything based on should handle this without breaking a sweat, as would . There are a vasty constellation of products out there that do this, both HP and Dell offer stuff that can do this as part of their software suites, and a whole host of commercial products (some of which are also based on the two free products I've already mentioned).

Most of these allow you to set alert thresholds for when certain things happen, like uplink ports exceeding 90% utilization.

share|improve this answer
    
and what about graphically creating the network topology and then say i click on the deices to see its stats –  nandonachi Oct 25 '12 at 8:03
    
@nandonachi HP OpenView was doing that back in 2001, and is a very common feature among paid Network Monitoring packages. The FOSS ones aren't as convenient, but can do the same thing if you work at it. –  sysadmin1138 Oct 25 '12 at 11:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.