mirror of the fastnetmon repo with rewritten history
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Pavel Odintsov 8103161125 Switched away from contains() as it's availbable only for C++ 20. Closes #983 3 days ago
.circleci Switched to next version which will be 1.2.6 3 weeks ago
.github Improved issue template 1 year ago
docs/images Added Grafana total traffic image 3 months ago
src Switched away from contains() as it's availbable only for C++ 20. Closes #983 3 days ago
.gitignore Adjusted to new path for proto file 3 months ago
.gitmodules Juniper Implementation (#747) 5 years ago
LICENSE Fixed bunch of paths to old versions of FNM 6 years ago
README.md Added README corrections recommended by Grammarly 3 weeks ago
SECURITY.md Update SECURITY.md 3 months ago
THANKS.md Added Rui Chen to Thanks file 7 months ago



Community Edition

FastNetMon - A high-performance DDoS detector/sensor built on top of multiple packet capture engines: NetFlow, IPFIX, sFlow, AF_PACKET (port mirror).

What do we do?

We detect hosts in the deployed network sending or receiving large volumes of traffic, packets/bytes/flows per second and perform a configurable action to handle that event. These configurable actions include notifying you, calling script or making BGP announcements.


🌏 Official site
FastNetMon Advanced, Commercial Edition
🌟 FastNetMon Advanced, free one-month trial
📜 FastNetMon Advanced and Community difference table
📘 Detailed reference
🔏 Privacy policy


Supported packet capture engines

  • NetFlow v5, v9, v9 Lite
  • sFlow v5
  • PCAP
  • AF_PACKET (recommended)
  • AF_XDP (XDP based capture)
  • Netmap (deprecated, still supported only for FreeBSD)
  • PF_RING / PF_RING ZC (deprecated, available only for CentOS 6 in 1.2.0)

You can check out the comparison table for all available packet capture engines.


  • Detects DoS/DDoS in as little as 1-2 seconds
  • Scales up to terabits on single server (sFlow, Netflow, IPFIX) or to 40G + in mirror mode
  • Trigger block/notify script if an IP exceeds defined thresholds for packets/bytes/flows per second
  • Complete support for most popular attack types
  • Thresholds can be configured per-subnet basis with the hostgroups feature
  • Email notifications about detected attack
  • Complete IPv6 support
  • Prometheus support: system metrics and total traffic counters
  • Flow and packet export to Kafka in JSON and Protobuf format
  • Announce blocked IPs via BGP to routers with ExaBGP or GoBGP (recommended)
  • Full integration with InfluxDB and Graphite
  • API
  • Redis integration
  • MongoDB protocol support compatible with native MongoDB and FerretDB
  • VLAN untagging in mirror and sFlow modes
  • Capture attack fingerprints in PCAP format

We track multiple platform and environment-specific metrics to understand ways how our product is being used and prioritise development accordingly.

Official support groups:

Follow us at social media:

Router integration instructions

Complete integration with the following vendors


Command line interface Main screen image

Standard Grafana dashboard Grafana total traffic

Example deployment scheme

Network diagramm

FastNetMon is a product of FastNetMon LTD, UK. FastNetMon ® is a registered trademark in the UK and EU.

CI build status


Upstream versions in different distributions

FastNetMon upstream distro packaging status