Friday, February 13, 2015

Open Source DoS/DDoS Analyzer / Mitigation Tool

FastNetMon:
           - high performance DoS/DDoS analyzer with sflow/mirror support and load analyzer builded on top of PF_RING.





FastNetMon - high performance DoS/DDoS and netflowk load analyzer builded on top of multiple packet capture engines (PF_RING, sFLOW, Netflow, PCAP).

What we do? We can detect hosts in our own network with big amount of packets per second/bytes per second or flow per second incoming or outgoing from certain host. And we can call external script which can send notify, switch off server or blackhole this client.
 

Features:
+ Can process incoming and outgoing traffic
+ Can trigger block script if certain IP load network with big amount of packets per second
+ Can trigger block script if certain IP load network with big amount of bytes per second
+ Can trigger block script if certain IP load network with big amount of flows per second
+ VLAN untagging
+ MPLS traffic processing
+ L2TP decapsulation of nested packets
+ PF_RING ZC/DNA support (wire speed processing on tens of MPPS but need license)
+ Can process sFLOW v5
+ Can work on mirror/SPAN ports
+ Can work on server/soft-router
+ Can detect DoS/DDoS in 1-2 seconds
+ Tested up to 10GE with 5-6 Mpps on Intel i7 2600 with Intel Nic 82599

Download Link : https://github.com/FastVPSEestiOu/fastnetmon


DDOSMON:
                  is a network analysis platform which is designed to find anomalous network patterns such as DDoS attacks and act on them automatically. It can do this either by directly sniffing or acting on netflow data export streams.

It is used by a few hosting providers and datacenters.




Program that uses low level linux packet sniffing in incoming network traffic for monitoring possible network attacks and reacting to them by alerting and triggering user defined self defence mechanisms.
With a ncurses interface you can monitor network traffic live and watch recent events. Logs are saved to log folder, any ddos attack detection send an email to the user.
It can classify following attacks:
  • SYN Flood
  • UDP Flood
  • ICMP Flood
Any other attack with massive amount of traffic or packet would still be detected.





Download Link : https://github.com/edubart/ddosmon

or

https://bitbucket.org/tortoiselabs/ddosmon/overview



2 comments:

  1. Office Professional Plus 2016 sale , keygen win 7 , how to purchase upgrade for genuine windows 7 basic , windows home server 2011 activation key , Office Home and Bussiness 2016 for Mac , free windows 7 ultimate product key that works? , buy win 7 product key card , windows vista home premium indir , lP5aDT

    cheap office project 2013 product keys

    buy windows 7 ultimate sp1 product key

    Online Windows 10 Pro Product Key Store

    Windows 7 Home Premium SP1 key code

    buy cheap windows 7 product keys

    ReplyDelete
  2. Completely agree... To avoid such mistakes open source code review tools are best options. Thanks for sharing valuable information.

    ReplyDelete