ddosmon

ddosmon copied to clipboard

DDOS Monitor

Program that uses low level linux packet sniffing in incoming network traffic for monitoring possible network attacks and reacting to them by alerting and triggering user defined self defence mechanisms.

With a ncurses interface you can monitor network traffic live and watch recent events. Logs are saved to log folder, any ddos attack detection send an email to the user.

It can classify following attacks:

• SYN Flood
• UDP Flood
• ICMP Flood

Any other attack with massive amount of traffic or packet would still be detected.

Building

git clone [email protected]:edubart/ddosmon ddosmon
cd ddosmon
mkdir build && cd build
cmake ..
make

Running

# optional, I usually run this inside a screen session
screen 

sudo ./build/ddosmon configs/example.lua

NOTE: Root is needed for sniffing the network adapter packets.

Scripts

Script called when a known DDOS attack starts or stops: ./scripts/networkcompromise <compromised/uncomprimised>

Script called to notificate admins (usually via email): ./scripts/notificate <subject> <message>

Script called when one of your servers ip address might be unreachable and you may want to block/unblock it from your main server: ./scripts/ipblock <block/unblock> <ip>

Configurations

You can find and edit these configuration for you needs inside configs/home.lua

• interface = "eth0"
• global_traffic_threshold = 900000
• global_packets_threshold = 225000
• ip_traffic_threshold = 500000
• ip_packets_threshold = 125000
• notification_traffic_threshold = 20000
• notification_packets_threshold = 20000
• ipblock_retry_ticks = 536001000
• notification_command = "./scripts/notificate "%1%" "%2%" &"
• onblockip_command = "./scripts/ipblock block %1% &"
• onunblockip_command = "./scripts/ipblock unblock %1% &"
• network_uncompromise_ticks = 30
• onnetwork_compromise_command = "./scripts/networkcompromise compromised &"
• onnetwork_uncompromise_command = "./scripts/networkcompromise uncompromised &"
• log="logs/home.log"
• watchedips="configs/example_watchedips.xml"
• notificationsubject="DDOS Monitor on server1 notification"

Watched IPs

NOTE: Don't foger to configure the ips you want to monitor in the example_watchedips.xml file.

This program was intended to monitor multiple ip addresses, so you can configure as many you like.