wong34539@yahoo.com Mon, 05/25/2009 - 18:15

The IP Accounting ACL identifies IP traffic that fails an IP access control list. This is a relevant security feature, because a sudden increase in traffic being blocked by an ACL can indicate a security attack in the network. Identifying IP source addresses that violate IP access control lists can help track down attackers. Alternatively, this mechanism can be used to identify when an attack is over, because an ACL is usually applied to block the attack. The data might also indicate that you should verify the network element configurations of the IP access control list. It is important to understand that the IP Accounting ACL does not account the amount of traffic that passes an individual ACL; therefore, it cannot be used for ACL optimization. However, the IP Accounting ACL can be used in conjunction with IP Accounting (Layer 3). For example, if ACLs are configured at a router, packets passing all ACLs are accounted by the IP Accounting (Layer 3) feature, and blocked traffic is collected via the IP Accounting ACL.


This Discussion