>What can we do? We can detect hosts in our networks sending or receiving large volumes of packets/bytes/flows per second. We can call an external script to notify you, switch off a server, or blackhole the client.
Watch out when implementing this stuff, it goes wrong way too often. At this point I have hard time not literally screaming at DC techs when my servers get suspended for "UDP flooding"[1] each other.
Bizarrely, that site disables not only my trackpad for scrolling, but also my cursor keys. I have to drag my pointer over to the scrollbar and move the page that way, like it's 1995.
Project site has some pretty aggressive scroll hijacking, it was basically unusable on my macbook 13" under Chrome... Guys, just drop the scroll hijacking.
Looks very nice. At my last place one of the enineers made something similar based on netflow and it worked really well, integrated with FlowSpec for mitigation.
Might give it a look.... even the screenshot of the real time top talkers looks like something interesting for the NOC to have up.
FastNetMon is kind of a hammer: inbound traffic to $x is exceeding bps or pps threshold -> trigger mitigation for $x (i.e. a remote blackhole). This is generally good enough to defend against the least sophisticated and most common attacks such as NTP, SSDP, DNS amplification attacks. Then there's a long tail of other attack types are not volumetric in nature and are more difficult to detect. That's a big part of what you pay for when you buy a commercial solution.
Then once an attack has been identified you want to specify mitigation policies: Customer A gets full mitigation, but customer B needs to be blackholed instead. If an attack is smaller than 10Gbps you want to simply insert some flowspec rules into your edge routers, but if the attack pattern is too random you will have to redirect a /32 to a specialized scrubbing device instead. Larger attacks you might want to announce through a DDoS protection service so you announce the /24 containing that IP address to your DDoS protection service to reduce bandwidth on your own uplinks, and so on. I could go on, I hope you get the idea :)
Got it thanks. Interesting. So do the usual router suspects (Cisco, Juniper etc) own this market? Does Google/AWS roll their own solutions? Any interesting startups taking them on?
Watch out when implementing this stuff, it goes wrong way too often. At this point I have hard time not literally screaming at DC techs when my servers get suspended for "UDP flooding"[1] each other.
[1] Otherwise known as OpenVPN