FastNetMon, an efficient DDoS attack detection and analysis tool

FastNetMon, an efficient DDoS attack detection and analysis tool

FastNetMon is an efficient analysis tool for DoS/DDoS attacks based on multiple packet capture engines (NetFlow, IPFIX, sFLOW, netmap, PF_RING, and PCAP). It can detect and analyze abnormal network traffic, you can also use external scripts to notify or block attacks.

Features

Able to process inbound/outbound traffic

If an IP address sends abnormal traffic, a blocking script can be triggered.

You can use ExaBGP to notify the BGP router of the blocked IP address.

DoS/DDoS detection within 1-2 seconds

Support plug-ins

Test supports up to 10GE, 5-6 Mpps (Intel i7 2600 & Intel Nic 82599)

Platform

Linux (Debian 6/7/8, CentOS 6/7, Ubuntu 12 +)

FreeBSD 9, 10, 11

Mac OS X Yosemite

Example

Cpu load under 400 kpps and Intel i7 2600 and Intel X540/82599 NI: