topic Re: CPS for Flood Protection in General Topics

CPS for Flood Protection

johnlinkowsky — Mon, 28 Jun 2021 22:07:47 GMT

For the Flood Protection calculations: Alarm, Activate, and Maximum - the documentation states to use the baseline thresholds (average) for the zone. I have used the OIDs to do this, however, why would I be using the TOTAL ZONE baseline and not just TCP CPS? As how else would I calculate UDP, and IP flood protection? They would ALL be set to the SAME RATES.

Shouldn't this be use the PROTOCOL baseline (SYN, TCP, IP, ICMP, etc.) to calculate the proper Alarm, Activate and Maximum settings?

Someone please help......

Re: CPS for Flood Protection

LAYER_8 — Mon, 31 Jan 2022 19:44:27 GMT

Your SE has access to a library of scripts that is able to calculate this for you, by the way

Re: CPS for Flood Protection

johnlinkowsky — Thu, 24 Mar 2022 16:38:52 GMT

Yes, I have those. Here is the issue. It just pulls the logs into a CSV file. That file is so big that when importing into Excel, in my environment, you only get about 3 mins worth of traffic. Clearly not enough to calculate.

I pivoted and used PRTG to graph CPS across time. This was the ONLY thing that I was able to use that was not manual.