09.04.2018

FastNetMon baseline calculation

Baseline calculation for FastNetMon can be little bit tricky and we prepared scripts to improve your experience during this process.

First of all, please enable visual traffic export and enable InfluxDB support for FastNetMon. Keep it running for 2-3 days (in best case, for one week to cover all peak hours)

Then, please isntall dependencies for script:

Please create file influxdb_baseline.py and put following content into it:

You need to run it this way:

It checks metrics for last 3 days (you can configure it in script) and selects more loaded hosts to use them as threshold. It will need some time (from few minutes to few hours depends on number of hosts).

Example output:

According to those values, it should be safe to set threshold_mbps to 1500 and set threshold_pps to 400000 pps. You can add 100-200% to peak value to reduce number of false positives.

We suggest to set these values as thresholds but keep FastNetMon in email notification mode (with BGP Blackhole disable) for 1 week and then you can put it into production if everything works fine.