FastNetMon Advanced is a network-level DDoS detection and mitigation solution that monitors network traffic, detects potential DDoS attacks, and automates protection using BGP Blackholing (RTBH), BGP FlowSpec, and traffic diversion.
Designed for Internet Service Providers (ISPs), hosting providers, data centres, and enterprise networks, FastNetMon Advanced helps protect infrastructure against Layer 3 and Layer 4 DDoS attacks.
Video: How DDoS Attacks Are Detected and Mitigated with FastNetMon
How Does FastNetMon Detect DDoS Attacks?
FastNetMon Advanced continuously analyses network traffic using telemetry collected from routers and switches.
It supports several traffic monitoring methods:
- NetFlow and IPFIX: Flow telemetry exported from routers and switches.
- sFlow: Sampled network traffic data used to monitor traffic patterns.
- Port mirroring (SPAN): Mirrored network packets captured directly from network interfaces.
FastNetMon analyses traffic metrics such as packets per second (PPS), bandwidth (Mbps), and protocol-specific traffic rates. It compares these measurements against configurable detection thresholds to identify potential DDoS attacks.
For example, FastNetMon can detect traffic patterns associated with UDP floods and TCP SYN floods by monitoring abnormal increases in the corresponding packet rates.
FastNetMon Advanced supports IPv4 and IPv6 DDoS detection, including monitoring traffic across dual-stack networks.
Documentation:
How Does FastNetMon Mitigate DDoS Attacks?
When FastNetMon Advanced detects a potential attack and the configured detection conditions are met, it can automatically trigger network-level DDoS mitigation.
Three common mitigation methods are:
1. BGP Blackholing (RTBH)
FastNetMon can automatically announce BGP routes to redirect traffic destined for an attacked IP address to a discard route.
This protects network infrastructure from excessive attack traffic but also blocks legitimate traffic destined for that IP address.
Read the BGP Blackhole automation documentation.
2. BGP FlowSpec
FastNetMon can analyse attack traffic patterns and generate BGP FlowSpec rules to filter matching malicious traffic on compatible network routers.
Unlike RTBH, BGP FlowSpec allows more selective filtering, potentially preserving legitimate traffic to the attacked destination.
Automatic generation of selective FlowSpec rules is supported for IPv4 attacks; automatic IPv6 mitigation uses blackholing.
Read the BGP FlowSpec configuration documentation.
3. DDoS Scrubbing Centre Diversion
FastNetMon Advanced can trigger DDoS traffic diversion to external scrubbing centres through BGP routing or supported API integrations.
The scrubbing centre filters attack traffic, allowing legitimate traffic to reach the protected network.
Read the DDoS scrubbing centre integration documentation.
Does FastNetMon Need to Be Installed Inline?
No. FastNetMon Advanced can operate out-of-band, receiving network traffic telemetry from existing routers and switches without being placed directly in the production traffic forwarding path.
Mitigation is enforced by the connected network infrastructure or integrated external systems.
Explore FastNetMon Advanced deployment options.
How Can Network Operators Monitor DDoS Attacks?
FastNetMon Advanced provides command-line tools for monitoring traffic, inspecting detected attacks, and managing mitigation settings.
It also offers FastNetMon LiveView, an optional web interface that provides real-time traffic dashboards, DDoS attack investigation, reporting, and configuration management.
Learn more about FastNetMon LiveView.
What Happens When a DDoS Attack Ends?
FastNetMon Advanced supports automatic withdrawal of mitigation actions. Depending on the configuration, it can check whether an attack has ended before removing a block.
This allows normal traffic routing to resume without requiring manual intervention for every attack.
Read about automatic unblocking.
Summary
FastNetMon Advanced works by collecting network telemetry, analysing traffic against detection thresholds, identifying potential DDoS attacks, and triggering automated network-level mitigation.
With support for NetFlow, sFlow, IPFIX, BGP FlowSpec, RTBH, and DDoS scrubbing centre integrations, it helps ISPs, hosting providers, and enterprises automate their DDoS protection workflows.
For more technical information, explore the FastNetMon Advanced documentation.
