wanderer/fastnetmon-rewritten
1
0
Fork 0
mirror of https://github.com/pavel-odintsov/fastnetmon synced 2024-11-23 21:43:14 +01:00
Code Issues Releases Activity
mirror of the fastnetmon repo with rewritten history
3,280 Commits 2 Branches 20 Tags 53 MiB
C++ 89.7%
Perl 6.3%
CMake 1.8%
PHP 0.8%
Python 0.7%
Other 0.4%
v1.2.4
Go to file
Pavel Odintsov c5090e8e84 Increased default threshold per host from 20k to 100k as 20k is too low for modern traffic speeds
2023-03-01 14:23:34 +00:00
.circleci Switched s3cmd installation on Debian 10 to pip 2023-02-27 22:36:25 +00:00
.github
docs/images Removed few documents which were moved to site long time ago 2022-08-31 12:13:06 +01:00
src Increased default threshold per host from 20k to 100k as 20k is too low for modern traffic speeds 2023-03-01 14:23:34 +00:00
.gitignore Adjusted to new path for proto file 2023-03-01 12:36:56 +00:00
.gitmodules
LICENSE
README.md Added CI build status in dedocated section 2023-03-01 13:24:48 +00:00
SECURITY.md
THANKS.md Added Rui Chen to Thanks file 2022-11-26 12:17:24 +00:00

README.md

logo

Community Edition

FastNetMon - A high performance DDoS detector / sensor built on top of multiple packet capture engines: NetFlow, IPFIX, sFlow, AF_PACKET (port mirror).

What do we do?

We detect hosts in the deployed network sending or receiving large volumes of traffic, packets/bytes/flows per second and perform a configurable action to handle that event. These configurable actions include notifying you, calling script or making BGP announces.

Legal

FastNetMon is a product of FastNetMon LTD, UK. FastNetMon ® is a registered trademark in the UK and EU.

CI build status

CircleCI

Project

🌏️ Official site
⭐️ FastNetMon Advanced, Commercial Edition
🌟️ FastNetMon Advanced, free one month trial
📜️ FastNetMon Advanced and Community difference table
📘️ Detailed reference
🔏️ Privacy policy

Supported packet capture engines

  • NetFlow v5, v9, v9 Lite
  • IPFIX
  • sFlow v5
  • PCAP
  • AF_PACKET (recommended)
  • AF_XDP (XDP based capture)
  • Netmap (deprecated, stil supported only for FreeBSD)
  • PF_RING / PF_RING ZC (deprecated, available only for CentOS 6 in 1.2.0)

You can check out the comparison table for all available packet capture engines.

Official support groups:

Follow us at social media:

Complete integration with the following vendors

Features

  • Detects DoS/DDoS in as little as 1-2 seconds
  • Scales up to terabits on single server (sFlow, Netflow, IPFIX) or to 40G + in mirror mode
  • Trigger block/notify script if an IP exceeds defined thresholds for packets/bytes/flows per second
  • Complete support for most popular attack types
  • Thresholds can be configured per-subnet basis with the hostgroups feature
  • Email notifications about detected attack
  • Complete IPv6 support
  • Prometheus support: system metrics and total traffic counters
  • Flow and packet export to Kafka in JSON and Protobuf format
  • Announce blocked IPs via BGP to routers with ExaBGP or GoBGP (recommended)
  • Full integration with InfluxDB and Graphite
  • API
  • Redis integration
  • MongoDB integration
  • Prometheus support
  • VLAN untagging in mirror and sFlow modes
  • Capture attack fingerprints in PCAP format

Running FastNetMon

Hardware requirements

  • At least 1 GB of RAM

Installation

Router integration instructions

Screenshots

Main screen image

Example deployment scheme

Network diagramm

Upstream versions in different distributions

FastNetMon upstream distro packaging status