pavel-odintsov/fastnetmon
Fastnetmon
FastNetMon is a network traffic analyzer and DDoS detection system designed to identify and mitigate distributed denial of service attacks. It functions as a BGP blackhole controller and mitigation orchestrator, monitoring network traffic in real time to detect hosts that exceed predefined thresholds for packets, bytes, or flows per second.
The system distinguishes itself through automated mitigation capabilities, using BGP-based route announcements to block malicious IP addresses across network infrastructure. It supports hardware-specific interventions for vendors such as Juniper and MikroTik and can execute custom scripts or API calls to manage firewall rules on external network appliances.
Its broader capabilities include multi-protocol ingestion of NetFlow, sFlow, and IPFIX data, as well as traffic capture via mirrored SPAN ports. The system aggregates these metrics in real time and can export traffic data to external storage for long-term analysis and visualization.
Features
- DDoS Attack Detections - Monitors network traffic volumes to identify hosts exceeding defined thresholds for packets, bytes, or flows per second.
- DDoS Protections - Automatically triggers routing announcements or custom scripts to block malicious traffic floods.
- Flow-Based DDoS Detection - Analyzes NetFlow, sFlow, and IPFIX data to identify and mitigate distributed denial of service attacks.
- Time-Window Aggregations - Aggregates incoming network metrics into short-term time windows to detect high-volume distributed attacks.
- Multi-Protocol Flow Ingestion - Supports diverse data sources including mirrored SPAN ports and multiple flow-export formats like NetFlow, sFlow, and IPFIX.
- Network Traffic Capture Engines - Ingests traffic data using standard flow and packet engines to analyze network patterns and communication behavior.
- Metric-Based Flow Analysis - Analyzes NetFlow, sFlow, and IPFIX records to track packet and byte counts per host.
- BGP Blackhole Controllers - Acts as a traffic mitigation tool that automatically triggers BGP routing announcements to block malicious IP addresses.
- BGP Route Advertisements - Automatically announces BGP blackhole routes to block malicious traffic at the network edge.
- Blackhole Routing Management - Manages blackhole rules on routers and network appliances to block traffic from identified attack sources.
- DDoS Mitigation Orchestrators - Executes custom scripts and manages firewall rules on routers to stop network attacks upon threshold breach.
- Routing Protocol Announcements - Implements BGP-based route announcements to block malicious IP addresses across network infrastructure.
- Malicious Traffic Blocking - Automatically blocks or redirects malicious traffic once detected attack volumes exceed defined thresholds.
- Network Hardware Integrations - Integrates with various routers and network appliances to coordinate traffic monitoring and mitigation across infrastructure.
- Network Traffic Analyzers - Captures and analyzes flow data or port mirroring to detect hosts sending excessive amounts of data.
- Threshold-Based Alerters - Triggers mitigation actions when traffic volumes for specific IP addresses exceed predefined per-second limits.
- Volumetric Attack Monitoring - Identifies high-volume distributed attacks in real-time by analyzing incoming network flow and packet data.
- Network Traffic Monitoring - Monitors traffic via flow data or port mirroring to identify hosts sending or receiving excessive amounts of data.
- Security Response Triggers - Triggers automated responses to traffic spikes via notifications, custom scripts, or network routing announcements.
- Appliance Mitigation Control - Triggers remote appliances to create protected objects and announce routing changes when a ban is detected.
- Router-Specific Firewall Rules - Provides automated firewall and blackhole rule management specifically for MikroTik routers to block attack sources.
- Vendor-Specific Mitigation - Manages blackhole rules or firewall filters specifically on Juniper hardware to block malicious traffic.
- Network and Infrastructure Security - Coordinates traffic monitoring and mitigation across multi-vendor routers and appliances to secure network hardware.
- Mitigation Plugins - Executes external scripts or API calls to apply firewall rules and routing changes across different hardware vendors.
- Infrastructure Monitoring - DDoS sensor with flow support.
