Program that uses low level linux packet sniffing in incoming network traffic for monitoring possible network attacks and reacting to them by alerting and triggering user defined self defence mechanisms.
With a ncurses interface you can monitor network traffic live and watch recent events. Logs are saved to log folder, any ddos attack detection send an email to the user.
It can classify following attacks:
- SYN Flood
- UDP Flood
- ICMP Flood
Any other attack with massive amount of traffic or packet would still be detected.
git clone [email protected]:edubart/ddosmon ddosmon
cd ddosmon
mkdir build && cd build
cmake ..
make
# optional, I usually run this inside a screen session
screen
sudo ./build/ddosmon configs/example.lua
NOTE: Root is needed for sniffing the network adapter packets.
Script called when a known DDOS attack starts or stops:
./scripts/networkcompromise <compromised/uncomprimised>
Script called to notificate admins (usually via email):
./scripts/notificate <subject> <message>
Script called when one of your servers ip address might be unreachable and you may want to block/unblock it from your main server:
./scripts/ipblock <block/unblock> <ip>
You can find and edit these configuration for you needs inside configs/home.lua
- interface = "eth0"
- global_traffic_threshold = 900000
- global_packets_threshold = 225000
- ip_traffic_threshold = 500000
- ip_packets_threshold = 125000
- notification_traffic_threshold = 20000
- notification_packets_threshold = 20000
- ipblock_retry_ticks = 536001000
- notification_command = "./scripts/notificate "%1%" "%2%" &"
- onblockip_command = "./scripts/ipblock block %1% &"
- onunblockip_command = "./scripts/ipblock unblock %1% &"
- network_uncompromise_ticks = 30
- onnetwork_compromise_command = "./scripts/networkcompromise compromised &"
- onnetwork_uncompromise_command = "./scripts/networkcompromise uncompromised &"
- log="logs/home.log"
- watchedips="configs/example_watchedips.xml"
- notificationsubject="DDOS Monitor on server1 notification"
NOTE: Don't foger to configure the ips you want to monitor in the example_watchedips.xml file.
This program was intended to monitor multiple ip addresses, so you can configure as many you like.