Sometimes ntopng is put under heavy pressure by scanners who create thousand flows/sec y wasting a lot of resources and loading the CPU.
As ntopng is able to recognise scans, it is requested to implement a mechanism what
whenever a IP source scanner is detected, it is insert on a special map for some time (e.g. 2 mins)
flows with client belonging to the above map are discarded and accounted as scans on the hosts belonging to the map, and the timeout for such host is reset
setup a trigger so that an external entity can be alerted when a scanner is detected
Sometimes ntopng is put under heavy pressure by scanners who create thousand flows/sec y wasting a lot of resources and loading the CPU. As ntopng is able to recognise scans, it is requested to implement a mechanism what