pavel-odintsov
commented
2 years ago Hello!
Thank you for sharing your feedback. Our code relies on fact that 5 tuple can be encoded into 64 bit integer https://github.com/pavel-odintsov/fastnetmon/blob/3a21ef0cb236280c99e4be0eb8791c5a7b4d896f/src/fastnetmon_types.hpp#L304 and it may be quite tricky to rework current approach for IPv6. So we will need some other logic.
I see new logic as completely different approach which stores all flows in tracking table and then does not flush it every period but just counts number of new flows for last period.
stkonst
The current code-base of fastnetmon is not supporting IPv6 flow-tracking. Thus, when an attacker is hitting our network, we can see at the client the pps and mbps counters increasing but not the flow counters. Thus, the flow-based DDoS detection and mitigation is useless in IPv6. AFAIK, the same issue applies at the advanced/paid version.
Thus, I would like to submit an RFE to the team to have this feature implemented and I am open to share details/requirements if needed.
Kind Regards Stavros