Why does your system need a “gatekeeper” like FastNetMon?
I once managed the infrastructure for an office of 50 employees along with a small datacenter cluster. There were days when the Internet would suddenly grind to a halt. Employees couldn’t check their email, but strangely, the server’s CPU and RAM usage remained extremely low. After 15 minutes of struggling with tcpdump, I discovered an IP address was being heavily flooded with traffic. Manually inspecting logs during such a crisis was a total nightmare.
That is where FastNetMon comes into play. Instead of resource-intensive packet capture, this tool analyzes Flow data (NetFlow, sFlow, IPFIX). Think of it as checking a phone bill to find out who is making harassing calls, rather than wiretapping every single conversation. This approach reduces CPU load by up to 90% compared to traditional methods, allowing attack detection within just 2-5 seconds.
Installing FastNetMon (Community Edition)
FastNetMon has two versions: Advanced (paid) and Community (free). For managing an office network or a medium-sized DC, the Community edition is more than sufficient. I prefer installing it on Ubuntu 22.04 LTS due to its high compatibility.
You can install it quickly using the official script:
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon_install.pl -O fastnetmon_install.pl
perl fastnetmon_install.plThe script will automatically detect the OS and install the necessary dependencies. This process usually takes about 3-5 minutes depending on your network speed. Once complete, the fastnetmon service will be ready to launch.
Detailed configuration to start identifying traffic
The main configuration file is located at /etc/fastnetmon.conf. This is the brain of the system, where you define data sources and alert thresholds.
1. Declare the IP ranges to protect
FastNetMon needs to know which IP ranges belong to you. List them in the /etc/networks_list file, one range per line:
1.2.3.0/24
192.168.1.0/242. Configure Flow detection
Open the /etc/fastnetmon.conf file. Depending on the network equipment you are using (Cisco Router, Mikrotik, or Juniper Switch), enable the corresponding protocol:
# NetFlow (Cisco, Mikrotik, Ubiquiti)
netflow = on
netflow_port = 2055
netflow_host = 0.0.0.0
# sFlow (HP, Juniper, Arista)
sflow = on
sflow_port = 6343
sflow_host = 0.0.0.03. Set Alert Thresholds
This is a crucial step. Setting thresholds too low will cause false alarms; setting them too high might cause the server to crash before it can react. For a common 100Mbps connection, I usually start with these safe parameters:
# Packets per second (PPS) threshold
threshold_pps = 20000
# Bandwidth threshold (Mbps)
threshold_mbps = 80
# Concurrent connections threshold
threshold_flows = 3500Save the file and restart the service to apply the changes: sudo systemctl restart fastnetmon.
Writing a response script for attacks
FastNetMon’s strength lies in its automation capabilities via notify_script. When it detects an IP exceeding a threshold, it triggers a script to perform actions such as sending a Telegram notification or pushing a BGP Blackhole.
Find the following line in the configuration file and point it to your script:
notify_script_path = /usr/local/bin/fastnetmon_notify.shBelow is a simple script template for logging and temporarily blocking an IP:
#!/bin/bash
# FastNetMon passes 3 parameters: IP, attack direction, and intensity
IP_TARGET=$1
DIRECTION=$2
echo "Warning: IP $IP_TARGET is under attack ($DIRECTION) at $(date)" >> /var/log/fastnetmon_attacks.log
# If running on a Gateway, you can block the IP using iptables
# iptables -I FORWARD -d $IP_TARGET -j DROPDon’t forget to grant execution permissions: chmod +x /usr/local/bin/fastnetmon_notify.sh.
Real-time monitoring via Dashboard
To monitor traffic in real-time, use the command:
fastnetmon_clientThis tool displays a list of the most bandwidth-hungry IPs. If you test a simulated attack using hping3, you will see the numbers spike and that IP will be immediately added to the “Ban list”.
My experience suggests combining FastNetMon with InfluxDB and Grafana. Visualizing data with charts makes it much easier to identify attack patterns compared to looking at dry command-line output.
Configuring the router to export Flow data might be a bit tricky at first. However, once running stably, FastNetMon acts as a silent guardian. You’ll be able to sleep soundly without worrying about being blindsided by sudden DDoS attacks.
