Fastnetmon 0pps

Hi Guys,

I want to use fastnetmon but i have an problem
after 1 min from restart of fastnetmon all incoming and outgoing ips have pps,mbps,flows equal to 0
Imediate after restart i have some values there but all of this value go down down down until 0 without any refresh (and i have some traffic) so normlay need to see some pps

Version: VyOS 1.3-rolling-202012160217
Release Train: equuleus

And also i use fastnetmon doc for this

set service ids ddos-protection direction ‘in’
set service ids ddos-protection listen-interface ‘eth0’
set service ids ddos-protection listen-interface ‘eth1’
set service ids ddos-protection listen-interface ‘eth2’
set service ids ddos-protection listen-interface ‘eth3’
set service ids ddos-protection listen-interface ‘eth4’
set service ids ddos-protection listen-interface ‘eth5’
set service ids ddos-protection mode mirror
set service ids ddos-protection network ‘x.x.x.x’
set service ids ddos-protection network ‘x.x.x.x’
set service ids ddos-protection network ‘x.x.x.x’
set service ids ddos-protection network ‘x.x.x.x’
set service ids ddos-protection network ‘x.x.x.x’
set service ids ddos-protection threshold fps ‘1000’
set service ids ddos-protection threshold mbps ‘50’
set service ids ddos-protection threshold pps ‘10000’

Where x.x.x.x are different /24

Some help?

Thanks,
Alin :slight_smile:

Try to check logs
/var/logs/fastnetmon/*log

this is from last restart

2021-02-25 08:55:49,270 [INFO] Logger initialized!
2021-02-25 08:55:49,271 [INFO] We have configured local syslog logging corectly
2021-02-25 08:55:49,271 [ERROR] We can’t find notify script /usr/local/bin/notify_about_attack.sh
2021-02-25 08:55:49,275 [INFO] Read configuration file
2021-02-25 08:55:49,275 [INFO] We start local syslog logging corectly
2021-02-25 08:55:49,275 [INFO] We loaded 0 networks from whitelist file
2021-02-25 08:55:49,275 [INFO] We are working on Linux and could use ip tool for detecting local IP’s
2021-02-25 08:55:49,293 [INFO] We found 8 local IP addresses and will monitor they
2021-02-25 08:55:49,293 [INFO] We loaded 4 networks from networks file
2021-02-25 08:55:49,293 [INFO] Totally we have 12 IPv4 subnets
2021-02-25 08:55:49,293 [INFO] Totally we have 0 IPv6 subnets
2021-02-25 08:55:49,293 [INFO] Total number of monitored hosts (total size of all networks): 1544
2021-02-25 08:55:49,293 [INFO] We need 0 MB of memory for storing counters for your networks
2021-02-25 08:55:49,293 [INFO] I will allocate 1 records for subnet 3141058570 cidr mask: 32
2021-02-25 08:55:49,293 [INFO] I will allocate 256 records for subnet 11882829 cidr mask: 24
2021-02-25 08:55:49,293 [INFO] I will allocate 1 records for subnet 28660045 cidr mask: 32
2021-02-25 08:55:49,293 [INFO] I will allocate 512 records for subnet 1581657 cidr mask: 23
2021-02-25 08:55:49,293 [INFO] I will allocate 1 records for subnet 18358873 cidr mask: 32
2021-02-25 08:55:49,293 [INFO] I will allocate 1 records for subnet 18424409 cidr mask: 32
2021-02-25 08:55:49,293 [INFO] I will allocate 512 records for subnet 11544921 cidr mask: 23
2021-02-25 08:55:49,294 [INFO] I will allocate 1 records for subnet 28322137 cidr mask: 32
2021-02-25 08:55:49,294 [INFO] I will allocate 1 records for subnet 28387673 cidr mask: 32
2021-02-25 08:55:49,294 [INFO] I will allocate 256 records for subnet 5822140 cidr mask: 24
2021-02-25 08:55:49,294 [INFO] I will allocate 1 records for subnet 22599356 cidr mask: 32
2021-02-25 08:55:49,294 [INFO] I will allocate 1 records for subnet 1684318400 cidr mask: 32
2021-02-25 08:55:49,294 [INFO] We start total zerofication of counters
2021-02-25 08:55:49,294 [INFO] We finished zerofication
2021-02-25 08:55:49,294 [INFO] We loaded 12 IPv4 subnets to our in-memory list of networks
2021-02-25 08:55:49,294 [INFO] AF_PACKET plugin started
2021-02-25 08:55:49,294 [INFO] AF_PACKET will listen on 6 interfaces
2021-02-25 08:55:49,294 [WARN] We support only single interface for AF_PACKET, sorry!
2021-02-25 08:55:49,294 [INFO] We have 24 cpus for AF_PACKET
2021-02-25 08:55:49,294 [INFO] Run banlist cleanup thread, we will awake every 60 second

You can use only one port. In port mirror mode.
Or you can mirror traffic from the switch to port VyOS and listen it with fastnetmon

You can be more specific? :smiley:
And i use embeded fastnetmon client into vyos 1.3
You weant to say to have only one of this set service ids ddos-protection listen-interface ‘eth5’

and also one more point
normaly i need to have 3 tables of measurments based on doc

show measurements

name: measurements


hosts

networks

total

But i have only 2 of them (hosts and total) but use the correct template into influxdb

templates = [
.networks. app.measurement.cidr.direction.resource”,
.hosts. app.measurement.cidr.direction.function.resource”,
.total. app.measurement.direction.resource”
]

Try to replace in the file /etc/fastnetmon.conf

mirror_afpacket = on
to
mirror = on

And restart fastnetmon service

If you want to use influxdb, you need to add it in the configuration ref. influx

We use only minimal config options for fastnetmon yet.

Well to allow fastnetmon to create network measurments row we need to set
enable_subnet_counters = on
Restart fastnetmon, and thet table row will be created.

Thanks,
Alin.