Routing

Expand all | Collapse all

Flowspec rules before or after sampling / packet flow.

Jump to Best Answer
  • 1.  Flowspec rules before or after sampling / packet flow.

    Posted 10-15-2020 00:23

    Hi

     

    Few questions. Hope someone can help.

    Let's say I have an incoming DDOS attack and I with bgp flowspec create a rule to rate-limit all udp from any to 1.0.0.1.

    Where in the packet flow would this rate-limit occur? For example is it ingress on all interfaces or is it only egress on the interface towards 1.0.0.1?

    Would the rate-limit occur after ingress sampling? (Will my flow collector see the traffic pre/post rate-limit)

     

    Thank you



  • 2.  Re: Flowspec rules before or after sampling / packet flow.
    Best Answer

    Posted 10-15-2020 03:09

    Hello,

    if You configured ingress interface sampling, then flowspec filters are executed AFTER such sampling.

    If You configured egress interface sampling, then flowspec filters are executed BEFORE such sampling.

    HTH

    Thx

    Alex



  • 3.  Re: Flowspec rules before or after sampling / packet flow.

    Posted 10-16-2020 05:37

    Awesome thanks. It's ingress sampling so then all will work as expected 🙂