cuddylier

I would also be interested in this as I have some servers on a ddos protected network but sometimes an attack can leak for a few seconds but I would...

I would just be using sflow so whatever that is, I don't think port mirroring?