Added bps and pps rates for incoming and outgoing for syslog attack alerts
Version 2.0.190
Added option to make syslog alerts
Version 2.0.189
Disabled flow spec call if we do not have any rules
Added vlan for ng parser
Fixed bug with too big packet buffer size in IPv6 mode
Exported parent_host_group flag for per host json callbacks
Fixed misnamed collect_attack_pcap_dumps and collect_simple_attack_dumps to their original meaning
Version 2.0.188
Fixed out of bound memory write in IPFIX code which break packet counter
Added logic to handle crashes when malformed data was sent to tera_flow port
Fixed bug caused by flexible hash clenup logic and when option unban_only_when_finished was set
Added conf options override_internal_traffic_as_incoming and override_internal_traffic_as_outgoing to alter logic for internal traffic
Version 2.0.187
Added Radware plugin fcli management
Version 2.0.186
Added flow per second rate
Version 2.0.185
gRPC and protobuf libraries upgrade
Version 2.0.184
Added TCP flag support for flow spec mode for Netflow capture
Version 2.0.183
Upgraded all libraries
Added options netflow_ignore_long_duration_flow_enable and netflow_long_duration_flow_limit and basic implementation of duration filter
Version 2.0.182
Added fcli autocompletion for bgp peers
Added support for context help for bgp and hostgroup
Updated cli library
Added logic to read flow spec announces from disk
Added option keep_flow_spec_announces_during_restart and added on-disk sync when we remove flos spec announce
Version 2.0.181
API: Added logic to retry connection to MongoDB 30 times with 5 second delay during initial startup
Added confirmation for create_configuration command in interactive mode
Allowed symbol – and uppercase letters in hostgroup and bgp peer names
Added logic to hide any passwords in configuration
Added agent IP information to details json packet dump
Added ASN and interface numbers in details JSON dump of packet
Version 2.0.180
Improved autocompletion for hostgroups
Fixed autocompletion artefacts (duplication) with many completion matches
Version 2.0.179
Improved blackhole persistency logic
Version 2.0.178
Added logic to immediately sync blocked IPv4 and IPv6 hosts with on disk dump for graceful restarts
Version 2.0.177
Added support for parent hostgroups to use networks list from another group
Version 2.0.176
Added IPv6 support for total hostgroups
Added IPv6 support for per-host hostgroups
Added support logic to parse ASN from sFlow
Version 2.0.175
We’ve deperecated flag netflow_ipv6 and now you need only process_ipv6_traffic
Version 2.0.174
Added option to autoamtically cleanup empty counters for IPv4 and IPv6 flexible counters. Significantly reduces CPU usage
Version 2.0.173
Added TCP SYN bandwidth and packet per second thresholds
Enabled IPv6 counter even if IPv6 processing is disabled completely
Version 2.0.172
Added support for offline licenses on machines without default route
Version 2.0.171
Added flows per second export to tracking server for new custom license types
Added counters about per header and per flow speed for system_counters
Version 2.0.170
Added logic to multiply packet rate on sampling rate in af packet mode
Fixed extremely old bug with traffic conversion to mbits it was cause of 5% traffic difference
Version 2.0.169
Improved build process
Version 2.0.168
Implemented option to export IPv6 counters to InfluxDB
Version 2.0.167
Added native Prometheus support for system counters
Improved Netflow error reporting in log
Version 2.0.166
Enabled flexible_traffic_calculation by default
Version 2.0.165
Added options gobgp_announce_whole_subnet_force_custom_prefix_length and gobgp_announce_whole_subnet_custom_prefix_length to override length for subnet announces
Added option to install Docker on Ubuntu 18.04
Added options gobgp_announce_whole_subnet_force_custom_ipv6_prefix_length and gobgp_announce_whole_subnet_custom_ipv6_prefix_length to override IPv6 announces
Improved logging for orphaned buckets cleanup
Unified IPv6 and IPv4 bucket cleanup function
Added debug logging for packet collection
Implemented batch processing for IPv4 and IPv6 bans. Previously, FastNetMon was able to run single ban action per ban function run (once per second). In this release it can ban any number of hosts each ban function call. It makes FastNetMon much more efficient agains attacks towards big number of hosts
Version 2.0.164
Added option netflow_ignore_sampling_rate_from_device to ignore Netflow v9 sampling rate announcements from device
Version 2.0.163
Added per protocol traffic counters for metrics export to Clickhouse: clickhouse_metrics_per_protocol_counters
Version 2.0.162
Added code to unban hostgroups automatically
Added attack notification pipeline for manual unblocks for hostgroups
Version 2.0.161
Added networks which belong to hostgroup to per-hostgroup callbacks
Added scope to distinguish per-host and per-hostgroup callbacks
Version 2.0.160
Suppressed log messages about InfluxDB and switched them to counters
Added option to build total hostgroups from per-host: build_total_hostgroups_from_per_host_hostgroups
Version 2.0.159
Implemented logic to export per protocol counters for hostgroups
Version 2.0.158
Added option to suppress automatic flow spec withdrawal: do_not_withdraw_flow_spec_announces_on_restart
Fixed bug with mongo session in fcli
Version 2.0.157
Added support to decode ASNs encoded as 2 byte values in IPFIX
Version 2.0.156
Reduced fcli timeout from 10 to 3 seconds to offer better experience in offline mode
Disabled increasing timeout during connection to MongoDB. Now we retry 10 times every 5 seconds
Version 2.0.155
Aded option to suppress pid file check when pid_file path is empty
Version 2.0.154
Added custom command to restart FNM on Docker
Added custom path for FastNetMon’s log in Docker setup
Added detailed error message to debug mmap issues
Added offline mode for fcli to avoid scary errors during database init process
Version 2.0.153
Added option to connect to MongoDB without authentication
Disabled requirement for non empty Mongo password in fcli
Version 2.0.152
Upgraded gRPC version in FastNetMon’s internal API
Suppressed verbose logging from BGP parser code
Version 2.0.151
Added support to export top remote talkers via fcli: show remote_host_counters
Version 2.0.150
Added support to account total traffic usage per hostgroup
Added threshold to run actions when total traffic for host group exceed limit
Introduced notify_script_hostgroup_enabled and notify_script_hostgroup_path for per-hostgroup notify script calls
Added flag enable_ban_hostgroup to control per hostgroup behaviour
Implemented per hostgroup counters for InfluxDB
Introduced optimized version of LPM lookup tree
Decoupled code which reads hostgroups with code which creates all support structures
Version 2.0.149
Added ASN lookup logic for IPv6 in traffic_db
Unified IPv4 remote and IPv6 traffic counters
Added IPv6 support for fill_dictionaries
Version 2.0.148
Implemented complete GCE support
Version 2.0.147
Added support for FireStore for hostgroups and bgp in fcli
Version 2.0.146
Completely working code to withdraw remote blackhole announces
Exported information about license status to FCLI
Added code which will trigger all callbacks for manually added flow spec rules
Version 2.0.145
Added option to add custom tags to InfluxDB metrics: influxdb_custom_tags, influxdb_tag_name, influxdb_tag_value
Added option to control partitioner between Kafka partitions: influxdb_kafka_partitioner
Added tracking for number of InfluxDB messages written to influxdb for system_counters
Version 2.0.144
Implemented export to InfluxDB over Kafka queue system
Fixed traffic_db.conf parser issues with empty keys
Version 2.0.143
Added Clickhouse bandwidth export for flexible counters mode
Version 2.0.142
Added system_counters hosts_hash_size_ipv6 and hosts_hash_load_factor_ipv6 for IPv6 performance debugging
Exposed debug options for flexible counters: hosts_hash_load_factor and hosts_hash_size
Added support for flexible counters which avoid memory allocation for hosts without traffic and sparse networks
FastNetMon will execute license check after checking for duplicate process in memory
Version 2.0.141
Enabled simple packet dump in email by default
Added command for installer to set password for Grafana from metdata service on GCE (sudo ./installer -set_visual_passwords_gce_metadata)
Added logic to use per VM configuration storage on GCE / Firebase
Version 2.0.140
Reduced amount of memory copy calls in Netflow code
Added counter to calculate number of Netflow v5 flows explicitly: netflow_v5_total_flows
Added conf option netflow_multi_thread_processing to control multi thread mode for Netflow
Added option to control number of working threads per port for Netflow: netflow_threads_per_port
Version 2.0.139
Fixed bug for secure version of http client
Added support for reading configuration from Google FireStore on GCE in FastNetMon
Version 2.0.138
Added support for storing information in Google Firebase from fcli
Added command to renew license automatically from fcli: sudo fcli set renew_licens
Version 2.0.137
Added 4 byte encoding support for IPFIX plugin to decode flow starts and ends
Version 2.0.136
Switched connection to license server to port 443 for better firewall compatibility
Version 2.0.135
Added ability to set number of hosts in output for fastnetmon_client
Added explicit code to process negative traffic recalculation delays
Added return code processing for notify script with arguments
Disabled ddos detection for outgoing traffic in default configuration to reduce false positive
Version 2.0.134
Added packet_dump_detailed with per field information about packet dump to JSON notify scripts and web callbacks
Version 2.0.133
Added option license_use_port_443 to switch to port 443 for all connections to license server
Version 2.0.132
Added support for InfluxDB authorisation
Version 2.0.131
Added new kind of whitelist which uses flow spec rules
Version 2.0.130
Passed client ip address from sFlow to Clickhouse
Version 2.0.129
Increased timeout for waiting Clickhouse from 3*5 to 5*15
Added notifications about BGP Flow spec mitigations in Grafana
Version 2.0.128
Added function to retrieve number of queues available on NIC
Added XDP_ZEROCOPY support for AF_XDP (not implemented yet)
Implemented single_remote_host_counters from fcli side
Migrated ARM64 build to Mongo 4.1. It has native repos for Ubuntu Bionic
Version 2.0.127
Added option to decapsulate external GRE tunnels: xdp_extract_tunnel_traffic
Version 2.0.126
Added counter for packets unparsed by XDP
Added option to switch interface into promisc for XDP
Version 2.0.125
Enabled influxdb_export_system_counters by default.
Changed influxdb host description: we allow domain names now
Added DNS resolution code for InfluxDB export engine
Version 2.0.124
Banned /0 IPv4 networks because customers can announces default gateway to FastNetMon using BGP integration
Fixed code which should prevent allocating memory for really big networks
Added new fields email_subject_blackhole_block, email_subject_blackhole_unblock, email_subject_partial_block
Version 2.0.123
Implemented commit operation for web api. It can be trigered with PUT method
Updated core libraries
Version 2.0.122
Upgraded Mongo C and C++ libraries to current versions.
Added fresh gRPC library for ARM64
Added option keep_blocked_hosts_during_restart to control graceful reload of FastNetMon for blackholed hosts.
Implemented logic to read blackholed hosts from disk
Added option do_not_withdraw_unicast_announces_on_restart which disabled automatic BGP withdrawal
Version 2.0.121
Added infinite loop prevention and limit for number of flowsets per packet
Version 2.0.120
Added field packet_dump to JSON callback script and web hooks
Version 2.0.119
Added debug message about field types in MongoDB
Added new logic to parser to read integers encoded as 64 bit integers in MongoDB
Regenerated parser for local_asn and remote_asn to support private 32 bit ASNs which exceed limit for 32 bit signed integer
Version 2.0.118
Added native support for Grafana notifications about attacks
Version 2.0.117
Fixed metric name from netflow_v9_duration_less_60_seconds to netflow_v9_duration_less_60_seconds
Added automatic Clickhouse user configuration if we know it
Switched to SHA 256 hashed password in Clickhouse configuration
Fixed bug with incorrect name for Other Packets dashboard for total traffic
Fixed bug with duplicated Incoming packets for per host traffic dashboard
Added Netflow v9 dashboard into default package
Nginx released native ARM64 packages for 18.04
Added IPFIX duration histogram for system_counters
Version 2.0.116
Added option remote_host_tracking to configure remote host tracking
Added options enable_ban_remote_outgoing and enable_ban_remote_incoming to control remote blocks behaviour
Added complete support for host groups remote_host_incoming/remote_host_outgoing for remote hosts
Added gobgp_announce_remote_host option to announce blackholed remote hosts using BGP
Added option gobgp_next_hop_remote_host to configure next hop for remote block hosts
Version 2.0.115
Added plugin for AF_XDP support
Added option force_native_mode_xdp to force native mode for XDP driver
Added XDP stats
Added poll backed processing for XDP mode: poll_mode_xdp. It significantly reduces load on CPU
Disabled gobgp init file creation from installer. We do it from FastNetMon’s deb package
Upgraded Grafana to 5.3.2.
Version 2.0.114
Added experimental flag gobgp_modern_configuration_format to switch GoBGP to upstream format (1.33 compatible)
Fixed bug with manual blackholes. Previously, all of them had 1970.1.1 date because we did not populate ban_time
Version 2.0.113
Added option to disable milti-thread processing completely for AF_PACKET with option set main mirror_af_packet_disable_multithreading
Replaced af_packet_ thread name to short afp_. We have limit for 16 symbols and it will improve performance profiling experience
Added option to control fanout (load balancing mode) for AF_PACKET: mirror_af_packet_fanout_mode: cpu, hash, random, rollover, queue_mapping
Version 2.0.112
HASH(0x55d394ef7698)
Version 2.0.111
Added command to configure mongodb initial configuration from fcli using fcli create_configuration
Version 2.0.110
Fixed bug for Netflow v9 processing code which caused infinite loop after receiving malformed packet
Version 2.0.109
Added ability to disable ban actions for incoming/outgoing traffic using: do_not_ban_outgoing and do_not_ban_incoming
Version 2.0.108
Upgraded Clickhouse library to new version (fixes retries and timeouts)
Version 2.0.107
Added option to switch connection tracking from flow to unique oppiste hosts tracking with sudo fcli set main connection_tracking_skip_ports
Version 2.0.106
Implemented sudo fcli show netflow_sampling_rates to expose sampling rate information for Netflow v9 agents
Added support for duration distribution for Netflow v5
Version 2.0.104
Added IPv6 support for IPFIX
Version 2.0.104
Fixed BGP Flow Spec validation bug for rules injected from API/fcli
Version 2.0.103
Added fcli/API command: bgp_incoming_announces to expose received BGP announces from peer
Version 2.0.102
Reintroduced Redis support
Version 2.0.101
Added default fields for metricDate for Clickhouse metrics to avoid timezone issues
Added automatic calculation for packetDate in traffic_db. We did it to eliminate timezone issues
Added https support for apt in installer
Enabled Ubuntu 18.04 by default
Added support for 18.04 for graphic stack installer
Version 2.0.100
Added agent ip address for Netflow v5
Added agent ip address for Netflow v9 and IPFIX
Added new field AgentIP address for Clickhouse
Enabled support for 18.04 in installer and switched 18.04 to MongoDB 4.0
Version 2.0.99
Added support for input and output interfaces for IPFIX
Added src and dst ASN support for IPFIX
Improved error reporting for Graphic stack installer
Added support for Clickhouse server automatic install with: -install_traffic_persistency
Version 2.0.98
Added ability to configure speed recalculation delay with option speed_calculation_delay. It’s quite useful for debugging and for customers with really huge networks
Version 2.0.97
Added support for duration histogram for Netflow v9
Version 2.0.96
Added variables netflow9_custom_sampling_rate_received and netflow9_sampling_rate_changes to track sampling rate learning for Netflow v9 better
Added netflow9_options_packet_number counter to debug Netflow issues
Initial support for viewing all availible options of fields in api
Version 2.0.95
Added export for system counters to InfluxDB: set main influxdb_export_system_counters
Added options for dpkg to suppress interactive reconfiguration attempts
Version 2.0.94
Added IPv6 support for Netflow v9 code
Version 2.0.93
Added https support for web hook handlers
Version 2.0.92
Boost library upgrade to fix locale related issues and add new functions
Version 2.0.91
Moved logging level reconfiguration close to toolkit run
Version 2.0.90
Introduced configuration option to configure logging level: sudo fcli set main logging_level debug
Fixed parser for flow spec detection enging for fragmented packets
Version 2.0.89
Added support for flow_spec_do_not_process_length_field and flow_spec_do_not_process_source_address_field for flow spec mitigations in sFlow/AF_PACKET modes
Version 2.0.88
Added configuration option flow_spec_do_not_process_source_address_field. It’s very useful to provide good level of aggregation for memcached/ssdp attack types
Version 2.0.87
Added per day partitioning for Clickhouse metrics
Version 2.0.86
Migrated to per day partitions for traffic_db/Clickhouse
Removed dependencies on libpcap and libnuma from deb package
Version 2.0.85
Added code for BPF sampling in AF_PACKET filter: mirror_af_packet_sampling_rate
Version 2.0.84
Added ability to change traffic_db configuration using configuration file
Added ARM64 compatibility
luajit code upgarde for ARM64
Added ARM64 version of installer tool
Switched BGP daemon logging to stdout for systemd enabled distros
Version 2.0.83
Improved compatibility with Ubuntu 18.04
Version 2.0.82
Added support for accept BGP Flow Spec action type
Unified upstart/systemd configuration for new Ubuntu distributions
Version 2.0.81
Added ability to override Router ID for BGP peers: gobgp_router_id Mandatory for IPv6 only setup.
Explicitly added local_address in BGP configuration
Version 2.0.80
Enabled option to use IPv6 only peers
Version 2.0.79
Implemented API and fcli to retrieve traffic for single host: fcli show single_host_counters 192.168.1.100
Version 2.0.78
Added network for host into JSON and text/email notifictions
Added protocol version to JSON and email/text notify scripts
FastNetMon can populate host group properly for manually created blackholes
Migrated MongoDB version 3.6
Version 2.0.77
Added community support for IPv6 mode
Added gobgp_community_host_ipv6 and gobgp_community_subnet_ipv6 to configure IPv6 independently
Working IPv6 BGP integration
Added configuration options for IPv6: gobgp_announce_host_ipv6 and gobgp_announce_whole_subnet_ipv6 to configure behaviour independently to IPv4
Added field gobgp_next_hop_ipv6 to configure IPv6 next hop
Implemented option to create IPv6 blackhole using cli
Added IPv6 unicast and flow spec AFI for GoBGP.
Version 2.0.76
Added basic ssh server into fcli: sudo -E SSH_SERVER_MODE=on ./fcli
Version 2.0.75
Full IPv6 support
Fixed whitelisting for IPv6
Fixed segmentation faults when fastnetmon load IPv6 network into whitelist
Version 2.0.74
Migrated to native Go interface code which creates fastnetmon user for MongoDB
Installer does not remove old configiration. It just renames it
Added autostart for BGP daemon
Complete support for IPv6 for notify json script and web hook
Implemented ability to show banned IPv6 address
Version 2.0.73
Introduces IPv6 mode in fastnetmon_client -ipv6
Version 2.0.72
Implemented ability for Netflow v9 to read input and output interfaces for packet from flow data
Netflow v5. Added ability to read input and output port numbers from Netflow packets
Added two new fields for Clickhouse schema: inputInterface and outputInterface
Version 2.0.71
Fixed bug with ASN population code
Version 2.0.70
Netflow plugin: implemented ability to read src and dst ASNs directly from Netflow v9 packet
Traffic db will not try to fill ASN information if we already have non zero ASN from FastNetMon
Version 2.0.69
Re-introduced fastnetmon_client toolkit to emulate old tool from FastNetMon Community
Added symlink for fastnetmon_client to call without full path
Introduced fake mode for fastnetmon_client using key z for example output
Version 2.0.68
Implemented support for multiple interfaces in AF_PACKET
Added new configuration option af_packet_read_packet_length_from_ip_header to read size from IP header instead of wire
Added option for strict CPU affinity for AF_PACKET: afpacket_strict_cpu_affinity
Version 2.0.67
Introduced complete support for licenses on grey IP addresses
Version 2.0.66
More robust license check code
Version 2.0.65
Complete web API
Automatic creation for all Clickhouse tables
Introduced ability to create database for Clickhouse metrics automatically
Added correct check to handle unreachable Clickhouse for metrics export
Version 2.0.64
Implemented option to export host counters using API
Version 2.0.63
Enabled IPv6 by default in traffic_db
Fixed bug with traffic_db. It crashed when we did not have Clickhouse running when traffic_db starts
Added check for correctness of networks in cidr for for fcli
Version 2.0.62
Introduced traffic_db_sampling_rate to configure sampling rate for AF_PACKET capture
Version 2.0.61
Added automatic schema cration for Clickhouse
Version 2.0.60
Fixed segmentation fault for fill_dictionaries: double memory free up
Version 2.0.59
Enabled API gateway by default
Version 2.0.58
Enabled code dump handlers for fill_dictionaries for debugging purposes
Version 2.0.57
Introduced JSON mode for fcli: JSON_MODE=on sudo -E ./fcli show bgp
Added JSON methods for almost all fcli commands
Version 2.0.56
Enabled batch mode for Clickhouse by default
Added automated deployment for all dashboards for Grafana
Implemened an ability to create InfluxDB data source with API in Grafana automatically
Improved InfluxDB installer to create database with proper retention
Version 2.0.55
Added debug messages about orphaned buckets
Version 2.0.54
Introduced support for md5 secured BGP sessions: md5_auth, md5_auth_password
Version 2.0.53
Improved license validation code on grey IPs
Version 2.0.52
Added options dump_all_traffic and dump_other_traffic to dump all/other traffic to log for debugging reasons
Introduced new option sflow_use_new_generation_parser which could enable new packet parser for parsing sFlow packets
Version 2.0.51
Added host group name to email/json notification about attack
Version 2.0.50
Introduced an ability to skip export of host counters to reduce lod on InfluxDB: influxdb_skip_host_counters
Added complete ignore to SIGHUP signal
Added suport for Ubuntu 16.04 for graphic stack
Version 2.0.49
Introuced per protocol counters export to InfluxDB: influxdb_per_protocol_counters
Version 2.0.48
Added option to list all interfaces availible in system: show interfaces
Fixed BGP daemon autostart unit
Version 2.0.47
Introduced separate repo for Ubuntu Trusty Tahr
Version 2.0.46
Made BGP Flow Spec valdiation configurable with configuration option: ‘flow_spec_execute_validation’
Introduced option to enable/disable network aggregation to reduce number of networks: ‘aggregate_networks_list’
Disabled configuration check for FastNetMon in systemd/Upstart unit
Version 2.0.45
Improvement for users with huge networks lists: we do not add small networks already added into lookup table as part of big networks
Version 2.0.44
Significant performance optimisation for users with big networks. 1.9 second => 0.7 second for /8 network
Performance improvement: reduced lock contention for DDoS checks
Added number of host groups to info log
Performance improvement. 3.5 seconds -> 1.9 seconds for 1m hosts for speed recalculation. Replaced copy by value to copy by reference
Version 2.0.43
Added fcli to PATH
Version 2.0.42
Added initial support for systemd
Version 2.0.41
Improved license validation code to ignore small differences in hardware configuration
Version 2.0.40
Added option to add simple packet dump to email: email_notifications_add_simple_packet_dump
Version 2.0.39
Introduced ASN lookup function for fcli: ‘show ip_asn 8.8.8.8’ you can use it to get ASN for any host
Version 2.0.38
Improved compatibility with SMTP protocol in email notifications
Added unique Linux thread names for all Netflow capture threads
Fixed bug which caused negative source_id in template cache
Version 2.0.37
Added new function for fcli to lookup host group for specified IP address: show ip_hostgroup 11.22.33.44
Upgraded HTTP library to new version. We use it for web_hooks and InfluxDB metrics export
Version 2.0.36
Added new configuration option flow_spec_do_not_process_length_field (main) to suppress any processing for length field. It’s useful in case when your device send incorrect IP length in Netflow/IPFIX
Version 2.0.35
Introduced configuration option flow_spec_fragmentation_options_use_match_bit (main). You could use it to enable match field inside BGP Flow Spec announces. Some vendors require this flags
Reworked code which handles BGP Flow Spec Fragmentation Flags
Version 2.0.34
Added option flow_spec_tcp_options_use_match_bit (main) to enable match bit in BGP Flow Spec announces. Some vendors require this flags
Traffic DB got an ability to create required databases/tables for traffic persistency automatically
Version 2.0.33
Fixes bug with zero packetDate in traffic db
In case of issues with connection with our traffic persistency backed FastNetMon could crash
Hide email password from output of show main command
Version 2.0.32
Added new plugin to read data in tera flow format from external sources (another FastNetMon instance).
Implemented enhanced error handling for write_simple_packet
Introduced filter to count full number of packets processed by process_packet function: total_simple_packets_processed
Version 2.0.31
Fixed bug with active option for BGP peers. Now we handle it correctly
Added support to store IPv6 address in tera flow format and inside tarffic persistency backed
Version 2.0.30
Implemented batch inserter for traffic persistency backend (significantly faster than old implementation)
Upgraded persistency database library integration. Fixed crash in case of connection issues with database
Version 2.0.29
Introduced autconnect logic for traffic persistency backend
Version 2.0.28
Rename process name fastnetmon to be unique line because it conflicts with Monit’s entity created for server itself
Disabled graphite by default. If somebody wants it he could enable it manually
Report incorrect value in field gobgp_flow_spec_default_action
Version 2.0.27
Fixed whitelising option (main)
Version 2.0.26
Implemented host_counters_v6 in fcli
Implemented method to export top IPv6 talkers
Version 2.0.25
Implemented full support for fcli command show sflow_sampling_rates. You could use it for sFlow sampling rate monitoring
Version 2.0.24
Implemented an ability to specify number of hosts in output of show host_counters with env variable: HOST_COUNTERS_MAX_HOSTS
Version 2.0.23
Introduced method license_hardware_data_reset to reset hardware assignment. You allowed to do it only three times
Version 2.0.22
Fix bug with vendor specific implementation issues. When we have padding at the end of sFlow packet we drop all frames. Now we process all of them correctly
Version 2.0.21
Introduced very nice optimization. Do not write zero elements to Clickhouse and InfluxDB
We introduced show latest_fastnetmon_version for fcli to get latest version of toolkit from server
Introduced ability to retrieve FastNetMon running version from fcli: show fastnetmon_version
Version 2.0.20
Introduced ability to execute notify script when attack mitigated with blackhole (for ban and unban). Also, introduced ability to call it when attack was mitigatied with flow spec (script call on announce withdrawal is not supported yet). Please set notify_script_format to json to use this option
Introduced variable to configure format for notify script. Now we support text and json formats
Version 2.0.19
Allow small memory differences for license server
Implemented network_counters_v6 in fcli
Implemented ability to get sorted average counters for IPv6 subnets
Fix bug in IPv6 get_packet_direction_ipv6. Now we could correctly detect outgoing traffic
Version 2.0.18
Implemented support for extracing IPv6 total counters using API: show total_traffic_counters_v6
Introduced special counter for non IPv4/IPv6 traffic: non_ip_packets.
Introduced option to disable/enable IPv6 traffic processing explicitly: process_ipv6_traffic
Version 2.0.17
Introduced ability to push network’s traffic to Clickhouse
Introduced ability to configure Clickhouse for metrics using configuration interface
Version 2.0.16
Fix bug in traffic presistency. Add correct traffic directions. Previously we had other everywhere
Version 2.0.15
Print ASN mapping file version to log file
Add special check that we could de-serialize data from ASN mapping table
Version 2.0.14
Moved message about absence of template to DEBUG level because customer complaints
Introduced additional log messages to debug Netflow templates delay
Version 2.0.13
Fixed issue: netflow_host ignored in previous releases
Version 2.0.12
Introduced ip_length field to track only IP packet total length (without Ethernet). We need it because BGP Flow Spec uses such representations
Version 2.0.11
Since this commit we retrieve attack bandwidth information from time when atatck was detected. This commit fixes cases when customer report that attack report was below threshold
Removed Average packet size for incoming traffic and Average packet size for outgoing traffic from attack details report
Unified smtp notifications. Do not block thread with email process. Let’s fork additional threads for this task
Introduced ability to remove packet length if we detected fragmentation attack. Implemented facility for rule optimisation
Added requirement to run fill_dictionaries from root
Version 2.0.10
Completely working ASN lookup for traffic database
Introduced src_asn and dst_asn fields for traffic db and simple packet
Implemented support for pushing data into Clickhouse
Version 2.0.9
Added upstart file for tera-tsdb
Version 2.0.8
Introduced ability to read MongoDB configuration options from special file in fcli
Introduced option to specify custom mongodb port for fcli
Moved configuration for mongodb for fcli to special file
Version 2.0.7
Added api_port configuration variable
Fixed bug in schema upgrade code inside CLI
Install pwgen by default
Introduced timeout for msmtp because without it it hangs completely
Version 2.0.6
Implemented native capability to push data into InfluxDB in batches. Previous we executed single write() operation for all calls
Fix Grafana configuration to work with nginx + http auth
Introduced special option for install tool to install Grafana, InfluxDB and Nginx
Switched to Stable version of Nginx
Version 2.0.5
Do not bother with ‘cache folder does not exists. Disabled Netflow cache option’ customers without Netflow enabled
Introduced new API method show license_hardware_data for getting information about hardware
Set average recalculation time to 5 seconds for networks too
Installer: Do not ask user about SPAN if we specified command line argument
Version 2.0.4
Implemented ability to pass information about pusblished flow spec mitigations with web hook
Reduced delay for attack detection from 3 seconds to 1 second
Remove information about subnet’s traffic from email notifications also. It’s useless technical information
Fix zero UUIDs for attacks in mongodb and for web hooks. Added complete attack description into json web hook
Use only smoothed (average) network counters for API / Graphite / InfluxDB export
Introduced new system counters to track number of hosts with traffic and without traffic.
Added new method for fcli to add new fields into schema for main configuration: upgrade_configuration
Reduced number of attempts to connect to MongoDB. Removed per-network stats from redis/mongo attack detail
Implemented ability to run FastNetMon without root permissions. Only for testing purposes.
Version 2.0.3
Fixed Netflow 9 sampling processing for case when we have non zero scope field
Fixed bug when we have multiple samplers in one packet. Fixes weird sampling rate for ASR devices
Version 2.0.2
Added timestamp in RFC 2822 to emails
Introduced configuration option to tune Netflow cache. Add explicit check that we should have cache folder for Netflow caches
Add handler for negative padding
Add support for sFlow packets with padding. We disovered this issue in Brocade ICX6610
Fix bug in installer. If we have /etc and /tmp on different block devices installer will fail to create configuration files
This site uses cookies to improve browsing experience: Find out more.