Probably, we went away from the topic. Feel free to raise PR if you want to have DOTS in FastNetMon. We'll review it carefully and if it fits our design guidance we will accept it.
Are there some good open source scrubbing center projects you might be able to recommend?
Also might you have any resources or links to how these scrubbing services are implemented, what heuristics they use etc?
I understand the front end of DDOS mitigation i.e netflows, BGP communities and RTBH, and GRE tunnels to the scrubbing centers. However the details of how the scrubbing centers works is something of a mystery to me.
When looking at any of the big DDOS provider's literature, the scrubbing centers are mostly just opaque boxes with little documentation on how they actually work.
"What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.
…
Why did we write this? Because we can't find any software for solving this problem in the open source world!
What is a "flow" in FastNetMon terms? It's one or multiple UDP, TCP, or ICMP connections with unique src IP, dst IP, src port, dst port, and protocol."
A flow is defined as a unidirectional sequence of packets with some common properties that pass through a network device. [...] for example, flow records include details such as IP addresses, packet and byte counts, timestamps, Type of Service (ToS), application ports, input and output interfaces, etc.
What's generally the state of the art in open source home/small office network monitoring? I would like to know and query/audit communication patterns of my devices. While maintaining privacy -> no cloud based commercial products.
Thanks. Sounds pretty hard if you're not a networking expert, and just have a cable modem plus wifi box. There's definitely a space for an easy to install solution here. Raspberry Pi based perhaps?
32 comments
[ 14.0 ms ] story [ 102 ms ] thread[1] https://datatracker.ietf.org/wg/dots/about/
https://mailarchive.ietf.org/arch/search/?email_list=dots&q=...
Thanks :)
I presume DOTS is transport, while Fastnetmon is detection, correct?
Also might you have any resources or links to how these scrubbing services are implemented, what heuristics they use etc?
I understand the front end of DDOS mitigation i.e netflows, BGP communities and RTBH, and GRE tunnels to the scrubbing centers. However the details of how the scrubbing centers works is something of a mystery to me.
When looking at any of the big DDOS provider's literature, the scrubbing centers are mostly just opaque boxes with little documentation on how they actually work.
It's in russian but Google trsnalate crashes language baarriers! :)
I think we definitely need some guide for Quick Start :)
"What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.
…
Why did we write this? Because we can't find any software for solving this problem in the open source world!
What is a "flow" in FastNetMon terms? It's one or multiple UDP, TCP, or ICMP connections with unique src IP, dst IP, src port, dst port, and protocol."
From here: https://tools.ietf.org/html/rfc3954
Glad to see this software exists. Had to help build a poor man's version of it at a previous job and it was half baked due to lack of time.
Aren't GPLv2 and Apache v2 licenses incompatible. How can they co-exist in the same project? (The copyright file says GPLv2, or is it GPLv2+?)
[0] http://metadata.ftp-master.debian.org/changelogs/main/f/fast...
And it's not used by version available in Debian repositories at all (just some experiments).
The project itself licensed strictly in terms of GPLv2 (not GPLv2+).
We will update proto file to this version in FastNetMon soon! :)
Practice of Network Security Monitoring - https://www.nostarch.com/nsm
& Tao of Network Security - http://www.informit.com/store/tao-of-network-security-monito...