On this page, you will learn about the options to set custom per-host thresholds for specific IPv4 or IPv6 prefixes in your networks.
By default, FastNetMon uses the same thresholds for all hosts in your network. They’re configured using a special hostgroup with the name “global”. It’s special in a way that it includes all networks added to networks_list, and you do not need to add any networks for it.
All recommendations (excluding the requirement to add any hosts to networks list) on this page can be applied to the “global” hostgroup.
It may be possible to use the same thresholds for all hosts, but in many cases, you will need to have multiple levels for different groups of hosts.
Most common cases are:
- Business customers
- Caches from content providers
- NAT pools
FastNetMon allows you to create a nearly unlimited number of so-called hostgroups and set custom threshold values for each of them.
Name of hostgroup can only consist of Latin letters (uppercase and lowercase), numbers and symbols “-” and “_”.
We do not recommend using a very large number of them, as it will make maintenance and configuration more complicated. We recommend keeping around 5-7 hostgroups to reflect the most popular traffic generation profiles.
To create a custom hostgroup, you can use the following command:
sudo fcli set hostgroup my_new_group
After this, you need to set the type for it, to reflect the fact that it will apply on a per-host basis only:
sudo fcli set hostgroup my_new_group calculation_method per_host
As the next step, you can add any number of IPv4 or IPv6 prefixes for hostgroups:
sudo fcli set hostgroup my_new_group networks 11.22.33.44/24 sudo fcli set hostgroup my_new_group networks 10.10.10.0/24 sudo fcli set hostgroup my_new_group networks beef::1/64
On this step, ensure that all these networks were added to networks_list as documented in this quick start guide.
To remove a network, use the following command:
sudo fcli delete hostgroup my_new_group networks 11.22.33.44/24
After this, set required thresholds for incoming traffic from all available threshold types:
sudo fcli set hostgroup my_new_group ban_for_bandwidth enable sudo fcli set hostgroup my_new_group threshold_mbps 200
To enable any attack actions (incoming or outgoing), enable ban for this hostgroup globally:
sudo fcli set hostgroup my_new_group enable_ban enable
You may keep enable_ban disabled, and in this case, FastNetMon will not trigger any attacks for IP addresses from that hostgroup.
As the next step, you can enable incoming attack alerts for this hostgroup:
sudo fcli set hostgroup my_new_group enable_ban_incoming enable sudo fcli commit
FastNetMon can detect outgoing attacks, and you can set outgoing thresholds separately in the following way:
sudo fcli set hostgroup my_new_group ban_for_bandwidth_outgoing enable sudo fcli set hostgroup my_new_group threshold_mbps_outgoing 200 sudo fcli commit
After this, enable attack detection in the outgoing direction:
sudo fcli set hostgroup my_new_group enable_ban_outgoing enable sudo fcli commit
To debug hostgroup logic, we have a command which returns the hostgroup name for each specified IP address:
sudo fcli show ip_hostgroup 1.2.3.4
Maximum number of hostgroups
There is no limit on the number of per-host hostgroups in place, hostgroup lookup logic uses a highly efficient tree-based data structure, which offers exceptional scalability with a larger number of hostgroups. We did lab testing with 2048 hostgroups, and it worked without any issues or degradation