Refer to the exhibit. An engineer configured SNMP traps to record spoofed packets drop of more than 48000 a minute on the ethernet0/0 interface. During an IP spoofing attack, the engineer noticed that no notifications have been received by the SNMP server. Which configuration resolves the issue on R1?
To configure the SNMP traps to record spoofed packet drops exceeding 48000 packets per minute on the ethernet0/0 interface, you need to ensure the notification threshold is correctly set. The calculation must match the rate of 48000 packets per minute. Since the threshold command `ip verify unicast notification threshold` specifies packets per second, you divide 48000 by 60 seconds to get 800 packets per second. Therefore, setting the threshold to 800 packets per second will meet the requirement of 48000 per minute for the notification to be triggered.
The "ip verify unicast notification threshold 800" command specifies the number of packets per second. So in this case, 800 packets a second X 60 seconds in a minute, you get 48,000 packets.
Great explanation!
How the hello are we supposed to know this sh1t? We don't work at Cisco TAC
A is correct 800 * 60 = 48000
correct