0

In Juniper Router MX480, we can configure the port mirroring of a transmit port.

then, is it possible calculate a IP of Transit Traffic's rate in Juniper port mirroring?

I mean, I can configure B port to mirroring the A port(main traffic through), there is a IP 203.0.113.5/24 transmit through port A.

can I get the IP 203.0.113.5/24's immediate rate? and judge condition to trigger a script?

EDIT-01

I want to solve this problem: such as in the router there access a 203.0.113.0/24, and the total rate is limited to 10Gbps, in the router I want limit each IP of the subnet to 100Mbps, if one of them override the limit, it will be blackhole(by trigger a script or other way).

because I give the example IP segment 203.0.113.0/24, in the actual situation, this is public IP addresses, the bandwidth of 203.0.113.0/24 is limited, and if one of the them are being flood attack, it will affect all the IPs under the traffic line.

suppose our AS6453 <-> AS10099:

enter image description here

all the traffic will be affect under the line.

Improve this question
7
  • Sounds like a bit of an XY problem. Perhaps you can describe your ultimate goal, rather than focusing on a particular solution method. What are you trying to accomplish?
    – Ron Trunk
    Commented Nov 13, 2020 at 13:12
  • I have edited it, please take a look.
    – 244boy
    Commented Nov 13, 2020 at 14:04
  • 1
    What you want is called QoS. You really do not want to perform a script.
    – Ron Maupin ♦
    Commented Nov 13, 2020 at 14:10
  • 1
    For a DoS attack you set up RTBH with your ISP to stop the traffic from reaching your AS. Anything you do on your AS is after the bandwidth has already been used. You can, of course, use QoS to police inbound traffic, but in an attack, you have already lost the bandwidth. You can police inbound, or shape/police outbound with QoS, but if I understand the problem you want to prevent the traffic from reaching your AS in the first place, and that would require assistance of the ISP.
    – Ron Maupin ♦
    Commented Nov 14, 2020 at 2:44
  • 1
    By the way, if you want to give example public addresses, then please do not use private addresses for that. IANA has set aside three networks to use for such examples: 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24. Using addresses in one of those ranges will let people know you mean disguised public addresses, but using private addresses just confuses the situation.
    – Ron Maupin ♦
    Commented Nov 14, 2020 at 2:46

1 Answer 1

Reset to default
1

It sounds like what you really want is a DDOS detection & automation system. Wanguard is probably the most popular small-scale solution. In your environment, you can use it to detect DDOS with Netflow/sFlow or a traffic mirror. It can then send alerts and generate BGP routes for black-holing, depending on how you configure it.

There are other software and hardware solutions available; but Wanguard probably fits your network scale best.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.