Hostgroup Overlap Question

[Jesse DuPont]

Hello. We are using the global hostgroup for detection, of DDOS's, which is working fine. However, we have three /32's that have the ability to consume data at a level which is surpassing the thresholds we have set on the global. Can I simply create a new hostgroup with those three /32's as the networks and apply different thresholds to that group and expect it to work? Will it work because the /32's are more specific than the larger prefixes which are part of global? Or do I need to take other steps to have different threshold apply to these /32's, which are part of the global networks_list?

Thanks!

--


Jesse DuPont

Owner / Network Architect
email: jesse....@celeritycorp.net
Celerity Networks LLC / Celerity Broadband LLC
Like us! facebook.com/celeritynetworksllc

Like us! facebook.com/celeritybroadband

 

[Pavel Odintsov]

Hello!

Yes, it will select /32 as more specific but you need to add each individual /32 into networks_list to make it work. 

--
Follow us on social media: Twitter: https://twitter.com/fastnetmon | Facebook: https://www.facebook.com/fastnetmon/ | LinkedIn: https://www.linkedin.com/company/fastnetmon/
---
You received this message because you are subscribed to the Google Groups "FastNetMon user group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fastnetmon+...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/fastnetmon/d4900b73-bbd7-a4c2-957a-6900158ffb76%40celeritycorp.net.

--

Sincerely yours, Pavel Odintsov

[Jesse DuPont]

Okay, thanks! Got it done, we'll test.



Jesse DuPont

Owner / Network Architect
email: jesse....@celeritycorp.net
Celerity Networks LLC / Celerity Broadband LLC
Like us! facebook.com/celeritynetworksllc

Like us! facebook.com/celeritybroadband