Hello. Thank you for coming. I'm very happy to see lots of people here. I hope you will
enjoy my presentation. So, I'm Pavel and I will talk about DDoS detection using opensource
tool. So, first of all, why and why I'm talking here. I'm software engineer. I got formal
educational software engineer and since the beginning of my career, I started working on
opensource and my first programming language was quite unusual, I would say. It was Pearl. So,
not fortunately choice for so many people, but for me it was a way into industry. So,
I worked it for domain name register. I worked it for cloud compute company. I worked it for
internet exchange. And finally, I got a job for global CDN provider and I ended up working in
cyber security. So, what I'm doing now, I'm in charge of development of cyber security product
for network security and this product is called Fastnetmon. So, I would like to start from brief
description what is Fastnetmon. Fastnetmon is an application. So, it's the very first thing to
clarify. It's cross-platform application and when I'm saying cross-platform, I mean Linux,
macros, free BSD, open BSD. It's not yet on Windows, but it's still. And main purpose of
Fastnetmon is DDoS detection for networks. From technical perspective, Fastnetmon is implemented
using modern C++. Back in time, it was quite interesting story when Fastnetmon was started.
But very, very first version of it in 2013 was implemented in C++ 11. But because of compilers
in some way, not so very modern distribution, we had to move back to C++ 98. Since then,
we still support modern versions. No way to like, no reason to maintain compatibility
is very outdated stuff. And now it's like, it's really good fancy C++. It's kind of C++
actually enjoy hacking, creating, and like changing if you prefer to do so. And I know
this feeling. When you hear about new stuff which may be relevant for you, that's the
first urge to maybe, should I try it now? Immediately. Because what is the point of
documentation? What's the point to hear my presentation? If you can just install it right
now? It did very long. It was very long journey. And I would like to thank you all for our
maintainers and who made it actually possible that Fastnetmon has so many distributions.
For almost every single popular distribution, I used mostly for server environment and production
environment, you may install Fastnetmon on just single command. So, it will start right
now if you prefer. And if for some reasons, your distribution have no latest distortion
Fastnetmon or you want to just install it, you know, for some distribution is not covered
by or official packages, there is installation tool. Let's go forward. Because most of the
time we talk about what our tools and our products can do. I would like to start from
unusual angle. I would like to highlight what we can do because it's important. Because
there are so many tools for DDoS detection. There are so many angles of DDoS detection.
It's detection of the part. It's mitigation part. It can be implemented on premise and
in cloud. And before we go into details what we are doing, we need to highlight what we
are not doing. And if you have any issues with your website or your blog, I'm sorry,
we can help you. It's not the point of Fastnetmon. It may indirectly help your carrier or service
provider. But for your case, it's better to use cloud services because it's not that
complicated to move site around. Because normally if you're not talking about really
enormous size, it's quite easy to move on to content delivery network and then coverage
from DDoS. And if you have some issues with DDoS when you play in your Xbox or PlayStation
also, I'm sorry, we cannot help you. This is decided at this slide because we have too
many questions. And I think it's one of the real serious problems in modern days because
you cannot play because of DDoS. And if you use managed service provider, it may be public
cloud, it may be private cloud. And when I say managed, it means that somebody in charge
of keeping your service running. And it's in this case, it's very unlikely that you
have access for your network. I mean, administrative level of access. It's a bit change policy,
inspire policy, change or alter configuration. And in this case, it's better to escalate
to your service provider like call for help. We have some problems. Help us. And finally,
what Fastnetmon can help you? Fastnetmon here is not to protect specific service. Fastnetmon
here to protect your network. And when I'm saying to protect network, it has very different
meaning from protecting specific entity. Main purpose of Fastnetmon to keep up time of all
network in general. And when I'm saying in general, it means that keep it running for
99% of customers, eyeball services behind the specific network. And I'll explain how
we can do it. What kind of attacks we can protect your network from? Again, there are
so many types of attacks. There are like so many opinions about classification of attack.
I'm not going to go into details about what the kinds of DDoS attacks. I would like to
focus it from well described OSI model approach. So what we can help you? We can help you with
IPv4 and IPv6 at the same time. If you still use IPv4, please don't. Please move away
from it. And in terms of layers of OSI model, we can help you only with levels L3 and level
4. And if you have some specific ideas, what is the option to filter out traffic using
like HTTP or two or three protocol encrypted by a TLS, it's better guess to try to just
present it like suricata because fastnet one is a little bit out of scope. Because main
purpose of fastnet is to detect volumetric DDoS attack. And when I say volumetric, it
means at least hundreds of megabits, but mostly in general case for every size of DDoS in
modern day, it's around 8 gigabits. And in some cases, it's exceptionally high, it's
maybe hundreds of gigabits. But on average, it's like just few gigabits. And this purpose
of fastnet to take this kind of attack. So what is the very first step when we assume
that network is under DDoS? Because when I'm saying assume, can we say for sure is it DDoS?
Because in so many cases, how we actually can absorb DDoS attack against our network?
Like you check your phone, it's not working. Like your website is not working. You check
like laptop in your office. And for some reason, something doesn't work as expected or customers
calling you. And first step is to confirm that actually DDoS. Because it may be not DDoS,
it may be fire alarm in your data center. Why it's extremely important that it's actually
DDoS? Because it may be something different. And in case of fire, it's way more important
and way more different kind of actions to remedy the DDoS detection. And if you know
by accident that some people, your colleagues working in data center right now, and it's
like the same timeline, you receive a call from customer like, something doesn't work,
it's very unlikely that it's DDoS. It's maybe caused by misconfiguration, because there
are so many ways how we can figure down time in our networks. And okay, we covered most
of the sources which can cause network DDoS, network down time, but actually DDoS. And
look, even this one, it's not DDoS. This one is, it can cause havoc. It can bring down
all cities, countries, data centers. But it's still not DDoS. And what is how we can say
like, this one's for sure DDoS. And graphs. The only way to be 100% sure it's graphs.
And by looking on this graph, if you know like, okay, my network generates like 100,000
packet per second, like 100 gigabits. And if you can see spikes by 20 gigabits, it's
very unlikely it is caused by something normal. It's very likely it is DDoS. So it's first
level of remediation, at first level, how fast that one can help you. Fast that one can
say for sure, in this kind of dashboard, that you are under DDoS. And then you can action
it appropriately because you are well prepared. You know what you can do. And what we can
do in this case. Fast that one provides lots of different dashboards. And main benefit of
those dashboards is that they're built not on physical level of network. Because when
I'm saying physical level of network, I mean a port counter, slow for specific interface,
slow for specific router. And what fast that one can do, it's more of a review of your
network from logical level. When I say logical level, it's more from networks, prefixes,
specific services. And in this case, fast that one can provide a required amount of
granularity. It's like total traffic for your network. In this case, you can see total
income and in case of any spikes here, you may see it almost immediately. It's one of
the benefits of fast net money. It's not historical data. It's data which actually was just received
from your routers. It's almost real time data. And so in the same case, again, from logical
perspective, it's not the, instead of seeing what is the load for specific interface on
my router, you can see information about how much traffic you have for specific prefix.
And you will aware what kind of service is running in specific prefix. And so you can
understand something wrong with this specific prefix. And again, the latest level of granularity
you may find even traffic for per host because you may know that for specific prefix, you
just have two services, very important services running. And then you can check what is the
load for example. And you can see immediately again in real time, what's wrong? If you can
see spike for this specific service, okay, we found victim, sadly. And fast net money
on graphic capabilities include complete support for influx DB graph it and plenty of graph
and a dashboard. I would like to send to community for contributing so many great dashboards
because when we started this idea, we implemented a few of them, quite basic ones, but community
did really great job by doing plenty of them. And actually, most of them are way better
than our official dashboards. And what is the source of this data? Is it AI or something
different? No. So we receive this information from our test or switches in your network.
And from perspective of protocols, we support almost all available protocols in market.
And of course, one of the most popular on its net flow, it's IP fix as flow. And in case
of last resort, if you have no an athlete, but net flow or IP fix in your network, you
can try to use port mirror for all cases fast and one can handle a really significant amount
of traffic. And there are plenty of confirmed deployments of fast net money exceeding at
least two terabits of capacity in total. So after you got all information, you may check
it manually. For example, again, right at this moment, this fast net money will see what
is your total load? What is load for specific network? What is the load for specific cost?
And for small networks are like, you may find immediately what is the victim? Because in
case of small network, you know, okay, I have 12 services move between and you can check
one by one. Can we do it for DDoS detection? And this one is just the not very precise
map of United Kingdom. And you can see there are lots of interconnections. It's not the
largest country of planet, but you can see amount of interconnections. It's incredible.
Even for medium sized internet service provider or telecom providers, they may cover at least
multiple countries. And you can see amount, even towns, even regions is incredible. And
if you talk about networks covering like multiple European countries or multiple countries in
maybe, for example, Asia, it's incredible amount of locations, incredible amount of entities.
You cannot check like, is it, for example, you are, we are under DDoS, you know for sure.
Let's check every single one plus million city in Europe. We cannot do it manually.
It's just impossible. Every single time from moving from large cities, we need to move
to regions. Then we need to check household by household because this specific attack
might begin specific person playing like Fortnite game in this specific building. You cannot
do it manually, unfortunately. If they move a little bit to data centers, data center
normally, as we can make here, it's single building, maybe huge building, but it's still
just one building. It's not like, it's not scattered over like continent. It's not scattered
over like a thousandth of kilometers. Is it easy to find out? No, unfortunately, because
sadly in data center, you may have more entities, more potential big teams of DDoS than actually
for large telecom networks. What we can do? Of course, as I mentioned, you can manually
check every single host available in network because we already got pretty great dashboard
and we have real time data coming from your routers. What is the logic? What is the way
how we can actually find that? Again, we have data about what is a bandwidth for specific
network? What is a packet rate for specific network? We can check every single host in
our network and find out. Again, in case of data center and large telecom networks, it's
impossible to do it manually. That's the reason how Fastnetone can help you. Fastnetone can
do it for you and it can do it really fast. For almost all protocol support by Fastnet
mode, we can offer detection time in less than five seconds. It's not about Fastnetone
can say, look, you're under DDoS because it may be clear from graphs. At this point
of time, Fastnetone can find out what is a specific service in your network which is
under attack right now. We will have this information in five seconds. Why it's important,
like five seconds? Why? Can we wait a little bit? Have a cup of tea or coffee and wait?
Unfortunately, we cannot. That's the main problem because back in time, when I started
working with DDoS attacks, it was around 2008. You can wait for around half hour when DDoS
attack starts from something like 10 megabits, maybe 15 megabits, 100 megabits. You may
have a cup of coffee, wait a little bit, 20, something like 50 megabits, 100 megabits.
It's growing. Now, what we can see, attack and escalate from 100 megabits to tens of
gigabits in like few seconds. And human being, unfortunately, I had to admit, cannot handle
it so fast. We need some machines because people who actually run DDoS, they have lots
of automation. And without having automation in place, we cannot defend it. So Fastnetone
provides this option for you. And instead of checking every single host in your network
manually, because it's still an option, you can verify. When you receive reports from
Fastnetone, you can check graphs. Like, is it DDoS? Is it looking like DDoS? Because
Fastnetone inside, it uses very simple rules. Like, if specific host in my network generates
more than 5 gigabits of bandwidth, and if specific host in my network generates more
than 100,000 packets per second, it's clearly DDoS. And after detection, what we can do,
and very first step, which is available for every single carrier on this planet, unfortunately,
it's free. This thing called BGP Blackhole. BGP Blackhole needs a little bit more clarification
how it works. And because of name, you may guess, if you put something into Blackhole,
you'll never see it again. And that's the point. And how Fastnetone can help and can
rely on BGP Blackhole to stop DDoS from network.
In the beginning of my presentation, I mentioned that Fastnetone here to protect your network,
not specific service. And it's really important, because BGP Blackhole can be described in
many words, because it's quite a complicated abstraction. But I would call it, it's like
religion sacrifice made by network engineers to keep their network running. Why am I saying
sacrifice? Because at this point of time, we know, for example, for our network, we
have 20,000 hosts. Let's imagine every single host, it's residential building somewhere
in Europe. And we know for sure, we are receiving DDoS right now. And our service degraded.
Our customers calling us. Our site doesn't work. Nothing works fine. And we can find
out what is the victim of this specific attack using Fastnetone. And we know specific host,
which is IPv4 or IPv6, which is a target of this DDoS attack. And what we need to do using
BGP Blackhole, we need to stop all traffic from coming to this specific host. Which means
if effectively disabling and unplugging this specific customer or service from the internet.
And that's how BGP Blackhole works. It's not about like firewall, which may block attackers.
In this case, we literally manually, voluntarily block target or attack. Just to save our network.
And that's only purpose of Fastnetone to stop it and do it automatically for you. So and
after you stop it, and you can see it exactly on this diagram. So we maintain the uptime
of network. And everything is skipped working by sacrificing just one host on your network.
And it doesn't mean that you just block it and go away sending it. I can email to customer,
look, we block at your service. We can help you. Sorry. There are so many ways how you
can actually keep this host running. But again, before you apply some actions, create plan,
what we can do, maybe you can call some specific providers to provide defense for it. You may
just, sorry. So you need to have some actions and better to apply these kind of actions
in quiet environment. Instead of having to deal with 20,000 of calling customers every
single like minute, you may block specific target, you may keep uptime of your network
back. And your, when your network is back to operation in quiet environment and way
quieter environment, nobody yelling to you, nobody calling you, decide other like cup
of coffee or tea, what is option, what we can do for this specific customer. And then
how Fastnetone can help you. And since beginning when Fastnetone was built, it was open source
from very first version. And a lot of features, I just explained it, they weren't invented
by our master plan or roadmap. They were part of community request. We receive it at GitHub
because of look, there is an option. I have a problem and I would like to solve it. So
since beginning Fastnetone was community driven project. And we have lots of community channels,
how you can cooperate with us, how you can share your stories, how you can ask questions.
And please join all of them and I will help you to answer your questions. Thank you.
Anybody has questions? Hi, thanks a lot, quite interesting. So I just wanted to ask you if
you ever felt the need to extend the way you collect data with other protocols, like for
example, any flavor of open config specifications or eventually BMP instead of BGP?
That's a great question. So question was, is it possible to use protocols like open BMP
or open con to feed more information to Fastnetone? In current generation of Fastnetone detection
tools, we mostly rely on traffic telemetry protocols, which actually carries part of
network packet. It's maybe header of network packet or it may be some meta information
about source port, source IP, destination for destination IP. And we don't use data
about BGP directly. The only way how we can actually interact with BGP is that we have
internal BGP demand based on go BGP, which actually injects information and announces
routers to your network. So we have no backward integration from network. So we have no way
how we can learn information from your network. But because we offer different APIs, we offer
different ways to automate and run callback scripts instead of just running BGP, you can
run your own Python script and then you can rely on information from third party source
and come by this information and make decisions using this information.
I was merely asking because for example, with the GNMI, you can have like a sort of retraction
on the network. So you can, based according to what you're receiving using IPv6, for example,
you can have like an action directly on routers, for example.
Yes. This is one of the ways how we can actually use so-called callback scripts because when
fastnet on detects attack, it can run specific script. It may be base script, Python script,
Perl script. And in this script, you will have access to basic information about attack
and information. What is the target? What is like host target? What is the type of attack?
What is the prefix target? And then using any like automation protocol, you can run actions
on routers. And because of most of the routers, they have, there are no specific, like, there
are no standard way how we can inject this kind of information for every single vendor
available on market. And we decide to move these attacks to more communities, so to implement
it on your own. And if you implement it, share this community.
One second. Can you do a BGP flow spec to, like, black hole?
That's a good question. So, back in time, we had BGP flow spec support based on exa-BGP,
but it was, like, pure C-level quality of implementation because it was just literally
hard called at least for DNS and SSDP amplification, but it worked well. So, the only, but unfortunately
because of complexity of working as API of exa-BGP using flow spec protocol, we decided
to remove this capability. And now the only way how you can actually inject flow spec
rules, like, because you can implement black hole using flow spec, you can run it using
go-BGP command line from callback scripts of faster one.
Okay. Thank you. Any more questions? No. Thank you very much.
Thank you for your time.