FastNetMon – A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines (NetFlow, IPFIX, sFLOW, SnabbSwitch, netmap, PF_RING, PCAP). What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client. To enable sFLOW, simply specify IP of the server running FastNetMon and specify (configurable) port 6343 To enable netflow, simply specify IP of the server running FastNetMon and specify (configurable) port 2055. What is a “flow” in FastNetMon terms? It’s one or multiple UDP, TCP, or ICMP connections with unique src IP, dst IP, src port, dst port, and protocol.
Name | Capture speed | Installation | CPU load | Platforms | Cost | Accuracy of attack detection | Speed of attack detection
netmap | Up to wire speed (10GE, 14 MPPS) | Need kernel module and NIC driver patch ixgbe provided . For FreeBSD could need kernel rebuild but patches are included to kernel | Normal | Linux, FreeBSD | BSD | Very accurate | Very fast
PF_RING | Up to 2-3 MPPS, 2-3 GE | Need kernel module install | Very big | Linux only | GPLv2 | Enough accurate | Very fast
PF_RING ZC | Up to wire speed (10GE, 14 MPPS) | Need kernel module + patched drivers (provided in package) | Normal | Linux only | Commercial ~200 euro | Very accurate | Very fast
pcap | very slow, 10-100 mbps | Simple | huge | FreeBSD, Linux | GPL | Not so accurate | Very fast
sFLOW | Up to 40-100GE | Very simple | Small | Linux, FreeBSD, MacOS | Free | Accurate but depends on sampling rate (1-128 sampling rate recommended but significantly depends on traffic in network) | Very fast
NetFlow | Up to 40-100GE | Very simple | Small for FastNetMon but could be huge for network equpment if implemented in software way | Linux, FreeBSD, MacOS | Free but could require additional licenses or hardware from network equipment vendor | Not so accurate | So slow, up to multiple minutes depends on flow timeout configuration on routers
AF_PACKET | Up to 2 MPPS/5-10GE | Very simple | Normal-huge | Linux (since 3.6 kernel) | GPLv2 | Very accurate | Very fast
For Debian 6, 7, 8 and CentOS 6, 7 and Ubuntu 14.04 and Fedora and Gentoo you should use the automatic installer:
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon_install.pl -Ofastnetmon_install.pl sudo perl fastnetmon_install.pl
Please keep in mind! We track some information about your machine (os type and distro version). If you do not want to share this information, please add flag
To intstall script call. But in this case we can’t improve FastNetMon for your distribution.
It’s REQUIRED to add all of your networks in CIDR notation (22.214.171.124/24) to the file /etc/networks_list in the form of one prefix per line. If you are running this software on an OpenVZ node, you may not need to specify networks explicitly, as we can read them from /proc/vz/veip.
You can whitelist prefixes by adding them to /etc/networks_whitelist (CIDR notation too).
Start main process:
Start the client process in another console:
To enable fastnetmon to start on server startup, please add the following line to /etc/rc.local:
If something goes wrong, please check logs:
tail -f /var/log/fastnetmon.log
When an incoming or outgoing attack occurs, the program calls a bash script twice (if it exists):
The first time when threshold exceed (at this step we know IP, direction and power of attack). Second when we collect 100 packets for detailed audit of what happened.
A sample script is provided and can be installed as follows:
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/notify_about_attack.sh -O/usr/local/bin/notify_about_attack.sh chmod 755 /usr/local/bin/notify_about_attack.sh
After downloading the file, you need to open it and configure the ’email_notify’ option as required.
You can use an alternative python script from here .
If you want to use unstable development branch, please use this syntax:
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon_install.pl -Ofastnetmon_install.pl sudo perl fastnetmon_install.pl --use-git-master
Example deployment scheme: