Offer ability to specify different thresholds for incoming and outgoing attacks

[pavel-odintsov]

But in some cases we can't detect attack direction correctly.

[zenvdeluca]

any plans on supporting different thresholds for protocols ? udp/tcp/icmp?

[pavel-odintsov]

After some code rewrite I will support this too. It's not a big deal ;)

Is it effective for mitigation in your practice?

[zenvdeluca]

In my scenario where I am basically oferring http and https to the world, I'd love to have a more conservative threshold for tcp, and a much lower and more sensitive threshold for udp, specially on well know amplified ports such as dns/utp/ssdp/etc udp ports.

Does that make sense ?

[pavel-odintsov]

I see it as this. We have global thresholds for pps/bps/fps for all
protocols. By default same thresholds used for all protocols. But we will
offer per protocol thresholds for tcp/udp/icmp and they will be used
instead global limits if we enable they.

So, do you need any way for detection source of attack detection? I.e. Do
you need any way to distinguish udp detected attack or icmp detected?

On Tuesday, June 16, 2015, Vicente De Luca notifications@github.com wrote:

In my scenario where I am basically oferring http and http services to the
world, I'd love to have a more conservative threshold for tcp, and a much
lower and more sensitive threshold for udp, specially on well know
amplified ports such as dns/utp/ssdp/etc udp ports.

Does that make sense ?

—
Reply to this email directly or view it on GitHub
https://github.com/FastVPSEestiOu/fastnetmon/issues/285#issuecomment-112220292
.

Sincerely yours, Pavel Odintsov

[zenvdeluca]

The global thresholds / protocol thresholds (optional/override) sounds perfect.

2nd question: source of attack its an good info in my case, as well distinguish which protocol the attack vectors is using. Both features allows us to trigger more specific countermeasure policies, giving more granularity to fight againts the DDoS in a less disruptive way.

[pavel-odintsov]

Roger!

2nd question is much complex. Because very often traffic going spoofed and when we get some traffic flow and try to block it we will block client.

Sure, I have some ideas for spoofing mitigation and we could try it in your env. But we will need full forward full BGP table to FastNetMon, it could be an issue sometimes.

[pavel-odintsov]

Part of this feature is implemented: https://github.com/FastVPSEestiOu/fastnetmon/issues/65 :)

[zenvdeluca]

if you can breakdown the same idea for protocols, giving us abilitity to specify different thresholds for tcp/udp/icmp, and group as well, will be more than perfect to cover mostly traffic patterns.

[pavel-odintsov]

Yep, It could be nice, I like this feature. But I need some refactoring for it....

[pavel-odintsov]

Hello, folks!

We have implemented per protocol thresholds here: https://github.com/FastVPSEestiOu/fastnetmon/issues/407

This ticket has another name and will alive until we decide what to do with it :)

[zenvdeluca]

a simple option like ban_for_outgoing = off might help a lot.
I have the interest in FNM processing outgoing flows (to send them to influxDB,etc), but not baning / calling notify / store redis for them.

[pavel-odintsov]

Issue with blocking fixed. Sorry :(

[VanDuy91]

Hello Pavel,
How could I ban for outgoing traffic without BGP Flowspec?
Thanks.

[pavel-odintsov]

Hello! Of course you can. FastNetMon checks all thresholds for both direction of traffic. It's completely unrelated to flow spec.

[VanDuy91]

The variables: process_outgoing_traffic, process_incoming_traffic, enable_ban, ban_for_bandwidth, which were enable. And threshold_mbps was set but ban action just applies to incoming traffic. Anything else needs to enable?

[pavel-odintsov]

You have to explicitly disable processing for incoming traffic if you need only outgoing:

process_incoming_traffic = off

[VanDuy91]

You have to explicitly disable processing for incoming traffic if you need only outgoing:

process_incoming_traffic = off

Thank you.
BTW, we can't ban outgoing and incoming traffic at the same time? It's an inconvenience if we set process_incoming_traffic = off for incoming traffic and vice versa.

[pavel-odintsov]

If you need ban for incoming and outgoing then your configuration is standard. FastNetMon works this way by default. You do not need any changes for proces_xxxx_traffic at all. FastNetMon will use same thresholds for both directions.

On Sun, 26 May 2019 at 13:24, VanDuy91 ***@***.***> wrote: You have to explicitly disable processing for incoming traffic if you need only outgoing: process_incoming_traffic = off Thank you. BTW, we can't ban outgoing and incoming traffic at the same time? It's an inconvenience if we set process_incoming_traffic = off for incoming traffic and vice versa. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#285?email_source=notifications&email_token=AAU56ZVV2AJBFKTASEFSXKLPXJ6PZA5CNFSM4BINHF7KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODWIEVAI#issuecomment-495995521>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAU56ZU7QIIM2SOJMMANRDDPXJ6PZANCNFSM4BINHF7A> .

-- Sincerely yours, Pavel Odintsov

[VanDuy91]

It's work. Thank you.

[pavel-odintsov]

Advanced version can do different thresholds for incoming and outgoing traffic: https://fastnetmon.com/docs-fnm-advanced/advanced-quick-start/