search

pavel-odintsov / fastnetmon

FastNetMon - very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
https://fastnetmon.com
GNU General Public License v2.0
3.4k stars 561 forks source link

Withdraw BGP announces on daemon restart #326

Open pavel-odintsov opened 9 years ago

pavel-odintsov commented 9 years ago

Hello!

Subject "When a prefix has been triggered and announced with exabgp => restart fastnetmon => withdrawal is not been send. Perhaps all prefixes should be flushed when fastnetmon will be restarted?".

We need think deeply about this feature. In case of huge attack we should not remove announce in any case.

But in some cases when attack finished and we restarted daemon we will get "lost announce" and this client will not be unbanned in any time.

I have few ideas: 1) Serialize all active bans to the Redis and read they on toolkit startup. But this approach will not help when FastNetMon crashed. 2) Implement timeout for ExaBGP and set it as twice ban time. It could help for case when FastNetMon crashed and could prevent. ExaBGP will trigger withdraw automatically if FastNetMon do not remove announce before.

Finally, we should implement 1+2 but I looking for second approach. But we need some help from Thomas Mangin here!

pavel-odintsov commented 8 years ago

It's really complicated. So we are looking for gobgp for this task.

pubyun commented 8 years ago

is it supported for gobgp now?

pavel-odintsov commented 8 years ago

Hello!

Unfortunately not yet.