2014-06-08 20:49:25 +02:00
FastNetMon
2013-11-14 09:23:10 +01:00
===========
2015-03-25 16:05:15 +01:00
Author: [Pavel Odintsov ](http://ru.linkedin.com/in/podintsov/ ) pavel.odintsov at gmail.com [Follow my Twitter ](https://twitter.com/odintsov_pavel )
2015-03-25 16:45:19 +01:00
Join to [maillist ](https://groups.google.com/forum/#!forum/fastnetmon ) Look at [road map ](docs/ROADMAP.md )
2015-03-10 23:38:10 +01:00
2015-06-15 11:59:12 +02:00
Chat: #fastnetmon at irc.freenode.net [web client ](https://webchat.freenode.net/ )
2015-06-18 09:39:19 +02:00
[Please fill survey, we need your voice! ](https://docs.google.com/forms/d/1YoXQImMeEjBH-JPz3KYtcDwknHs8xrI538ObwSy9uZo/viewform )
2015-06-18 09:01:33 +02:00
2014-06-23 14:55:20 +02:00
License: GPLv2
2013-10-18 12:09:53 +02:00
2015-03-23 11:39:08 +01:00
FastNetMon - A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines (NetFlow, IPFIX, sFLOW, netmap, PF_RING, PCAP).
2013-10-18 12:21:41 +02:00
2015-03-10 21:06:21 +01:00
What can we do? We can detect hosts in our own network with a large amount of packets per second/bytes per second or flow per second incoming or outgoing from certain hosts. And we can call an external script which can notify you, switch off a server or blackhole the client.
2013-10-22 01:29:00 +02:00
2015-06-05 13:04:12 +02:00
- [VyOS based iso image with bundled FastNetMon ](docs/VYOS_BINARY_ISO_IMAGE.md )
2015-03-25 14:53:32 +01:00
- [Binary rpm packages for CentOS 6/7 and Fedora 21 ](docs/INSTALL_RPM_PACKAGES.md )
- [Automatic install script for Debian/Ubuntu/CentOS/Fedora ](docs/INSTALL.md )
2015-04-24 12:55:42 +02:00
- [Manual install on FreeBSD and Dragonfly BSD ](docs/FreeBSD_INSTALL.md )
2015-03-25 14:53:32 +01:00
- [Manual install on Mac OS X ](docs/MAC_OS_INSTALL.md )
- [Manual install on Slackware ](docs/SLACKWARE_INSTALL.md )
2015-05-02 18:07:00 +02:00
- [Manual install for VyOS ](docs/VyOS_INSTALL.md )
2014-11-22 14:24:50 +01:00
2015-05-02 18:37:08 +02:00
[](https://travis-ci.org/FastVPSEestiOu/fastnetmon) [](https://gitter.im/FastVPSEestiOu/fastnetmon?utm_source=badge& utm_medium=badge& utm_campaign=pr-badge) [](http://waffle.io/FastVPSEestiOu/fastnetmon)
2015-05-02 18:36:34 +02:00
2015-04-28 21:39:08 +02:00
Supported packet capture engines:
2015-03-23 11:39:08 +01:00
- NetFlow v5, v9
- IPFIX
2015-03-23 11:37:29 +01:00
-  v5
2015-03-23 11:39:08 +01:00
- Port mirror/SPAN capture with PF_RING (with ZC/DNA mode support [need license ](http://www.ntop.org/products/pf_ring/ )), NETMAP and PCAP
2015-03-23 11:37:29 +01:00
2015-04-28 21:39:08 +02:00
You could look [comparison table ](https://github.com/FastVPSEestiOu/fastnetmon/blob/master/docs/CAPTURE_BACKENDS.md ) for all available packet capture engines.
2014-11-22 14:17:26 +01:00
Features:
- Can process incoming and outgoing traffic
2015-05-07 16:06:47 +02:00
- Can trigger block script if certain IP loads network with a large amount of packets/bytes/flows per second
2015-04-26 15:00:47 +02:00
- Could [announce blocked IPs ](docs/EXABGP_INTEGRATION.md ) to BGP router with [ExaBGP ](https://github.com/Exa-Networks/exabgp )
2015-05-10 20:50:41 +02:00
- Have integration with [Graphite ](docs/GRAPHITE_INTEGRATION.md )
2015-03-15 19:07:19 +01:00
- netmap support (open source; wire speed processing; only Intel hardware NICs or any hypervisor VM type)
2015-03-10 21:06:21 +01:00
- Supports L2TP decapsulation, VLAN untagging and MPLS processing in mirror mode
2014-11-22 14:17:26 +01:00
- Can work on server/soft-router
- Can detect DoS/DDoS in 1-2 seconds
2015-05-13 23:06:47 +02:00
- [Tested ](https://github.com/FastVPSEestiOu/fastnetmon/blob/master/docs/PERFORMANCE_TESTS.md ) up to 10GE with 12 Mpps on Intel i7 3820 with Intel NIC 82599
2015-01-26 13:11:51 +01:00
- Complete plugin support
2015-05-08 18:00:48 +02:00
- Have [complete support ](docs/DETECTED_ATTACK_TYPES.md ) for most popular attack types
2014-11-22 14:17:26 +01:00
2015-01-09 23:53:31 +01:00
Supported platforms:
2015-04-26 21:30:38 +02:00
- Linux (Debian 6/7/8, CentOS 6/7, Ubuntu 12+)
2015-02-10 14:36:09 +01:00
- FreeBSD 9, 10, 11
2015-05-19 00:14:27 +02:00
- Mac OS X Yosemite
2015-06-12 21:05:32 +02:00
Supported architectures:
- x86 64 bit (recommended)
- x86 32 bit
2015-01-09 23:53:31 +01:00
2015-03-10 21:06:21 +01:00
What is "flow" in FastNetMon terms? It's one or multiple udp, tcp, icmp connections with unique src IP, dst IP, src port, dst port and protocol.
2013-10-22 01:29:00 +02:00
2015-03-10 21:06:21 +01:00
Main program screen image:
2014-06-08 12:30:03 +02:00
2015-03-22 11:45:52 +01:00
2014-06-08 12:29:37 +02:00
2015-03-10 21:06:21 +01:00
Example for cpu load on Intel i7 2600 with Intel X540/82599 NIC on 400 kpps load:
2015-03-22 11:45:52 +01:00
2014-06-08 12:29:37 +02:00
2014-11-22 14:17:26 +01:00
Example deployment scheme:
2015-03-22 11:45:52 +01:00
2014-11-14 21:43:00 +01:00
2015-05-07 16:00:29 +02:00
Example of [notification email ](docs/ATTACK_REPORT_EXAMPLE.md ) about detected attack.
2014-12-02 14:42:40 +01:00
2015-03-17 10:14:49 +01:00
To enable sFLOW simply specify IP of server with installed FastNetMon and specify port 6343.
To enable netflow simply specify IP of server with installed FastNetMon and specify port 2055.
2015-03-25 16:05:15 +01:00
Why did we write this? Because we can't find any software for solving this problem in the open source world!
2015-03-17 10:14:49 +01:00
How I can help project?
2015-06-17 10:58:52 +02:00
- We are looking for maintainer for Debian and Fedora/EPEL packages
2015-03-17 10:14:49 +01:00
- Test it!
- Share your experience
2015-06-17 10:58:52 +02:00
- Share your use cases
2015-03-17 10:14:49 +01:00
- Share your improvements
2015-03-22 12:09:29 +01:00
- Test it with different equipment
2015-03-17 10:14:49 +01:00
- Create feature requests
