Aerosol Posted March 22, 2015 Report Share Posted March 22, 2015 Author: Pavel Odintsov pavel.odintsov at gmail.com My TwitterLicense: GPLv2FastNetMon - A high performance DoS/DDoS and netflowk load analyzer built on top of multiple packet capture engines (netmap, PF_RING, sFLOW, Netflow, PCAP).What can we do? We can detect hosts in our own network with a large amount of packets per second/bytes per second or flow per second incoming or outgoing from certain hosts. And we can call an external script which can notify you, switch off a server or blackhole the client.Why did we write this? Because we can't find any software for solving this problem in the open source world!Install manual for any LinuxInstall manual for FreeBSDInstall manual for Mac OS XInstall manual for SlackwareFeatures:Can process incoming and outgoing trafficCan trigger block script if certain IP loads network with a large amount of packets per secondCan trigger block script if certain IP loads network with a large amount of bytes per secondCan trigger block script if certain IP loads network with a large amount of flows per secondnetmap support (open source; wire speed processing; only Intel hardware NICs or any hypervisor VM type)PF_RING ZC/DNA support (wire speed processing on tens of MPPS but needs license)Can process sFLOW v5Can process NetFlow v5, v9, ipfixCan use PCAP for packet sniffingCan work on mirror/SPAN portsSupports L2TP decapsulation, VLAN untagging and MPLS processing in mirror modeCan work on server/soft-routerCan detect DoS/DDoS in 1-2 secondsTested up to 10GE with 5-6 Mpps on Intel i7 2600 with Intel Nic 82599Complete plugin supportSupported platforms:Linux (Debian 6/7, CentOS 6/7, Ubuntu 12+)FreeBSD 9, 10, 11Mac OS X YosemiteWhat is "flow" in FastNetMon terms? It's one or multiple udp, tcp, icmp connections with unique src IP, dst IP, src port, dst port and protocol.Main program screen image:Example for cpu load on Intel i7 2600 with Intel X540/82599 NIC on 400 kpps load: Example deployment scheme: Example of first notification:subject: Myflower Guard: IP xx.xx.xx.xx blocked because incoming attack with power 120613 ppsbody:IP: XX.XX.XX.XXInitial attack power: 98285 packets per secondPeak attack power: 98285 packets per secondAttack direction: outgoingIncoming traffic: 62 mbpsOutgoing traffic: 65 mbpsIncoming pps: 66628 packets per secondOutgoing pps: 98285 packets per secondIncoming flows: 16Outgoing flows: 16IncomingUDPxx.xx.xx.xx:33611 < 216.239.32.109:53 729021 bytes 5927 packetsxx.xx.xx.xx:33611 < 216.239.34.109:53 231609 bytes 1883 packetsxx.xx.xx.xx:33611 < 216.239.36.109:53 728652 bytes 5924 packetsxx.xx.xx.xx:33611 < 216.239.38.109:53 414387 bytes 3369 packetsxx.xx.xx.xx:38458 < 216.239.32.109:53 724347 bytes 5889 packetsxx.xx.xx.xx:38458 < 216.239.34.109:53 222753 bytes 1811 packetsxx.xx.xx.xx:38458 < 216.239.36.109:53 729267 bytes 5929 packetsxx.xx.xx.xx:38458 < 216.239.38.109:53 383514 bytes 3118 packetsxx.xx.xx.xx:42279 < 216.239.32.109:53 687201 bytes 5587 packetsxx.xx.xx.xx:42279 < 216.239.34.109:53 248091 bytes 2017 packetsxx.xx.xx.xx:42279 < 216.239.36.109:53 737508 bytes 5996 packetsxx.xx.xx.xx:42279 < 216.239.38.109:53 321276 bytes 2612 packetsxx.xx.xx.xx:51469 < 216.239.32.109:53 735663 bytes 5981 packetsxx.xx.xx.xx:51469 < 216.239.34.109:53 237267 bytes 1929 packetsxx.xx.xx.xx:51469 < 216.239.36.109:53 735663 bytes 5981 packetsxx.xx.xx.xx:51469 < 216.239.38.109:53 318570 bytes 2590 packetsOutgoingUDPxx.xx.xx.xx:33611 > 216.239.32.109:53 531309 bytes 6107 packetsxx.xx.xx.xx:33611 > 216.239.34.109:53 531222 bytes 6106 packetsxx.xx.xx.xx:33611 > 216.239.36.109:53 531222 bytes 6106 packetsxx.xx.xx.xx:33611 > 216.239.38.109:53 531222 bytes 6106 packetsxx.xx.xx.xx:38458 > 216.239.32.109:53 527220 bytes 6060 packetsxx.xx.xx.xx:38458 > 216.239.34.109:53 527133 bytes 6059 packetsxx.xx.xx.xx:38458 > 216.239.36.109:53 527133 bytes 6059 packetsxx.xx.xx.xx:38458 > 216.239.38.109:53 527220 bytes 6060 packetsxx.xx.xx.xx:42279 > 216.239.32.109:53 539052 bytes 6196 packetsxx.xx.xx.xx:42279 > 216.239.34.109:53 539052 bytes 6196 packetsxx.xx.xx.xx:42279 > 216.239.36.109:53 539139 bytes 6197 packetsxx.xx.xx.xx:42279 > 216.239.38.109:53 539139 bytes 6197 packetsxx.xx.xx.xx:51469 > 216.239.32.109:53 532701 bytes 6123 packetsxx.xx.xx.xx:51469 > 216.239.34.109:53 532701 bytes 6123 packetsxx.xx.xx.xx:51469 > 216.239.36.109:53 532701 bytes 6123 packetsxx.xx.xx.xx:51469 > 216.239.38.109:53 532788 bytes 6124 packetsExample of second notification:subject: Myflower Guard: IP xx.xx.xx.xx blocked because incoming attack with power 120613 ppsbody:IP: xx.zz.xx.12014-11-21 08:01:11.419798 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419799 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419816 xx.xx.xx.xx:51469 > 216.239.36.109:53 protocol: udp flags: size: 87 bytes2014-11-21 08:01:11.419837 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419838 216.239.34.109:53 > xx.xx.xx.xx:33611 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419859 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419877 xx.xx.xx.xx:51469 > 216.239.38.109:53 protocol: udp flags: size: 87 bytes2014-11-21 08:01:11.419884 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419891 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419906 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419907 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419908 216.239.38.109:53 > xx.xx.xx.xx:42279 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419916 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419917 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419929 216.239.38.109:53 > xx.xx.xx.xx:33611 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419961 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419962 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419963 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytes2014-11-21 08:01:11.419963 216.239.32.109:53 > xx.xx.xx.xx:38458 protocol: udp flags: size: 123 bytesTo enable sFLOW simply specify IP of server with installed FastNetMon and specify port 6343. To enable netflow simply specify IP of server with installed FastNetMon and specify port 2055.How I can help project?Test it!Share your experienceShare your improvementsTest it with different equipmentCreate feature requestsLink: https://github.com/FastVPSEestiOu/fastnetmon Quote Link to comment Share on other sites More sharing options...