DDoS: CAR vs TCP-Intercept vs NetFlow

["Rubens Kuhl Jr." <rkuhljr () uol com br>]

Have anyone performed an evalution of rate-limiting SYN packets (CAR) versus
using TCP-Intercept ? What responds better to a DDoS attack (assume
SYN-flooding only) ? What uses more router resources ?

For better performance of CAR or TCP-Intercept, NetFlow switching (ip
route-cache flow) should also be used, besides CEF ?



Rubens Kuhl Jr.