wanderer/fastnetmon-rewritten
1
0
Fork 0
mirror of https://github.com/pavel-odintsov/fastnetmon synced 2024-11-23 05:02:10 +01:00
Code Issues Releases Activity
mirror of the fastnetmon repo with rewritten history
500 Commits 2 Branches 20 Tags 53 MiB
C++ 89.7%
Perl 6.3%
CMake 1.8%
PHP 0.8%
Python 0.7%
Other 0.4%
6392b6952d
Go to file
Pavel Odintsov 6392b6952d Proof of concept for bug report to netmap
2015-02-12 18:23:18 +03:00
example_plugin Add ability to read main config file from plugins 2015-01-27 12:53:55 +03:00
images Move images to separate folder 2014-12-01 13:05:39 +04:00
libpatricia Fixes in performance tests 2015-01-10 01:56:00 +03:00
netflow_plugin Fix bugs found by clang 2015-02-10 00:08:36 +03:00
pcap_plugin Fix for compilation on Mac OS X Yosemite 2015-02-10 12:35:03 +03:00
pfring_plugin Fix bug with ifdef. We have built PF_RING on travis since now 2015-02-10 11:29:54 +03:00
sflow_plugin Add additional check for sflow listener 2015-01-26 17:37:36 +03:00
tests Proof of concept for bug report to netmap 2015-02-12 18:23:18 +03:00
.travis.yml We try to enable PF_RING build on Travis 2015-02-10 11:11:28 +03:00
build_plugin_tester.sh Fixes for support PF_RING plugin in plugin runner 2015-02-03 23:05:16 +03:00
build_syn_umbrella.sh Rename builder script for Syn Umbrella 2015-01-25 22:35:02 +03:00
BUILDING_FREEBSD_KERNEL_FOR_NETMAP.md Add line for enable autload on server startup 2015-02-12 16:24:08 +03:00
Changes add changes 2014-03-12 14:49:43 +04:00
CMakeLists.txt Add FreeBSD support for log4cpp 2015-02-10 16:07:53 +03:00
fastnetmon_client.cpp Remove using namespace std in fastnetmon_client 2015-01-27 22:46:33 +03:00
fastnetmon_install.pl Fix installer 2015-01-29 13:55:26 +03:00
fastnetmon_types.h Some fixes for netflow integration in main tool 2015-01-23 19:37:23 +03:00
fastnetmon.conf Enable processing in both directions by default 2015-01-28 10:50:36 +03:00
fastnetmon.cpp Biggest refactoring ever have just finished! Core PF_RING moved to plugin 2015-02-03 22:55:44 +03:00
FINE_TUNING.md Fix in readme about build flags 2015-01-24 18:34:06 +03:00
FreeBSD_INSTALL.md Fix path. At FreeBSD we should use /usr/local/src instead /usr/src. 2015-02-12 13:20:36 +03:00
GeoIPASNum.dat Add flags to compile statically 2014-06-08 23:22:17 +04:00
INSTALL.md Separate fastnetmon into two tools: lient and server 2014-12-22 18:39:46 +03:00
LICENSE Initial commit 2013-10-18 03:09:53 -07:00
MAC_OS_INSTALL.md Fix in Mac manual 2015-02-10 13:55:47 +03:00
MANUAL_INSTALL.md Add install guide for Mac OS X 2015-02-10 13:54:59 +03:00
NETFLOW_DISADVANTAGES.md Upgrade documentation 2014-11-22 17:17:26 +04:00
notify_about_attack.sh Add ability to separate bans and attack details collection 2014-12-11 23:32:36 +03:00
pfring_parser_zc_issue.c Fix example code 2014-12-11 19:27:24 +03:00
plugin_runner.cpp Fixes for support PF_RING plugin in plugin runner 2015-02-03 23:05:16 +03:00
README.md Fix in README 2015-02-12 13:24:30 +03:00
reset_redis_stats Add scrip for reset redis stats 2014-12-03 18:59:15 +03:00
SLACKWARE_INSTALL.md Add guides for Slackware from Martin Stoyanov 2015-02-10 14:17:53 +03:00
syn_umbrella.cpp We handle forst SYN and second ACK now 2014-12-24 15:15:15 +03:00
THANKS.md Complete FreeBSD support 2015-02-10 16:36:09 +03:00

README.md

FastNetMon

Author: Pavel Odintsov pavel.odintsov at gmail.com License: GPLv2

FastNetMon - high performance DoS/DDoS and netflowk load analyzer builded on top of multiple packet capture engines (PF_RING, sFLOW, Netflow, PCAP).

What we do? We can detect hosts in our own network with big amount of packets per second/bytes per second or flow per second incoming or outgoing from certain host. And we can call external script which can send notify, switch off server or blackhole this client.

Why we write it? Because we can't find any software for solving this problem not in proprietary world not in open source.

Build Status Gitter

Features:

  • Can process incoming and outgoing traffic
  • Can trigger block script if certain IP load network with big amount of packets per second
  • Can trigger block script if certain IP load network with big amount of bytes per second
  • Can trigger block script if certain IP load network with big amount of flows per second
  • PF_RING ZC/DNA support (wire speed processing on tens of MPPS but need license)
  • Can process sFLOW v5
  • Can process NetFlow v5 and v9
  • Can use PCAP for packet sniffing
  • Can work on mirror/SPAN ports
  • Support L2TP decapsulation, VLAN untagging and MPLS processing in mirror mode
  • Can work on server/soft-router
  • Can detect DoS/DDoS in 1-2 seconds
  • Tested up to 10GE with 5-6 Mpps on Intel i7 2600 with Intel Nic 82599
  • Complete plugin support

Supported platforms:

  • Linux (Debian 6/7, CentOS 6/7, Ubuntu 12+)
  • FreeBSD 9, 10, 11
  • Mac OS X Yosemite

What is "flow" in FastNetMon terms? It's one or multiple connection udp, tcp, icmp with unique src IP, dst IP, src port, dst port and protocol.

Main programm screen image:

Main screen image

Example for cpu load for Intel i7 2600 with Intel X540/82599 NIC on 400 kpps load: Cpu consumption

Example deployment scheme: Network diagramm

Example of first notification:

subject: Myflower Guard: IP xx.xx.xx.xx blocked because incoming attack with power 120613 pps
body:
IP: XX.XX.XX.XX
Initial attack power: 98285 packets per second
Peak attack power: 98285 packets per second
Attack direction: outgoing
Incoming traffic: 62 mbps
Outgoing traffic: 65 mbps
Incoming pps: 66628 packets per second
Outgoing pps: 98285 packets per second
Incoming flows: 16
Outgoing flows: 16
Incoming

UDP
xx.xx.xx.xx:33611 < 216.239.32.109:53 729021 bytes 5927 packets
xx.xx.xx.xx:33611 < 216.239.34.109:53 231609 bytes 1883 packets
xx.xx.xx.xx:33611 < 216.239.36.109:53 728652 bytes 5924 packets
xx.xx.xx.xx:33611 < 216.239.38.109:53 414387 bytes 3369 packets
xx.xx.xx.xx:38458 < 216.239.32.109:53 724347 bytes 5889 packets
xx.xx.xx.xx:38458 < 216.239.34.109:53 222753 bytes 1811 packets
xx.xx.xx.xx:38458 < 216.239.36.109:53 729267 bytes 5929 packets
xx.xx.xx.xx:38458 < 216.239.38.109:53 383514 bytes 3118 packets
xx.xx.xx.xx:42279 < 216.239.32.109:53 687201 bytes 5587 packets
xx.xx.xx.xx:42279 < 216.239.34.109:53 248091 bytes 2017 packets
xx.xx.xx.xx:42279 < 216.239.36.109:53 737508 bytes 5996 packets
xx.xx.xx.xx:42279 < 216.239.38.109:53 321276 bytes 2612 packets
xx.xx.xx.xx:51469 < 216.239.32.109:53 735663 bytes 5981 packets
xx.xx.xx.xx:51469 < 216.239.34.109:53 237267 bytes 1929 packets
xx.xx.xx.xx:51469 < 216.239.36.109:53 735663 bytes 5981 packets
xx.xx.xx.xx:51469 < 216.239.38.109:53 318570 bytes 2590 packets


Outgoing

UDP
xx.xx.xx.xx:33611 > 216.239.32.109:53 531309 bytes 6107 packets
xx.xx.xx.xx:33611 > 216.239.34.109:53 531222 bytes 6106 packets
xx.xx.xx.xx:33611 > 216.239.36.109:53 531222 bytes 6106 packets
xx.xx.xx.xx:33611 > 216.239.38.109:53 531222 bytes 6106 packets
xx.xx.xx.xx:38458 > 216.239.32.109:53 527220 bytes 6060 packets
xx.xx.xx.xx:38458 > 216.239.34.109:53 527133 bytes 6059 packets
xx.xx.xx.xx:38458 > 216.239.36.109:53 527133 bytes 6059 packets
xx.xx.xx.xx:38458 > 216.239.38.109:53 527220 bytes 6060 packets
xx.xx.xx.xx:42279 > 216.239.32.109:53 539052 bytes 6196 packets
xx.xx.xx.xx:42279 > 216.239.34.109:53 539052 bytes 6196 packets
xx.xx.xx.xx:42279 > 216.239.36.109:53 539139 bytes 6197 packets
xx.xx.xx.xx:42279 > 216.239.38.109:53 539139 bytes 6197 packets
xx.xx.xx.xx:51469 > 216.239.32.109:53 532701 bytes 6123 packets
xx.xx.xx.xx:51469 > 216.239.34.109:53 532701 bytes 6123 packets
xx.xx.xx.xx:51469 > 216.239.36.109:53 532701 bytes 6123 packets
xx.xx.xx.xx:51469 > 216.239.38.109:53 532788 bytes 6124 packets

Example of second notification:

subject: Myflower Guard: IP xx.xx.xx.xx blocked because incoming attack with power 120613 pps
body:
IP: xx.zz.xx.1
2014-11-21 08:01:11.419798 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419799 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419816 xx.xx.xx.xx:51469 > 216.239.36.109:53 protocol: udp flags:  size: 87 bytes
2014-11-21 08:01:11.419837 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419838 216.239.34.109:53 > xx.xx.xx.xx:33611 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419859 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419877 xx.xx.xx.xx:51469 > 216.239.38.109:53 protocol: udp flags:  size: 87 bytes
2014-11-21 08:01:11.419884 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419891 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419906 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419907 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419908 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419916 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419917 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419929 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419961 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419962 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419963 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes
2014-11-21 08:01:11.419963 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags:  size: 123 bytes

How to enable sFLOW? Please specify IP of server with installed FastNetMon and specify 6343 port.