FastNetMon

https://fastnetmon.com/docs/
Admin
FastNetMon is a high-speed network traffic monitoring and DDoS attack detection system that captures...
Tokens:161,106
Snippets:1,921
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### Download and Execute FastNetMon Installer

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-install-guide

Use these commands to download the FastNetMon installer script, make it executable, and then run it to begin the installation process. Ensure you have root privileges.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer
```

--------------------------------

### Enable and Start FerretDB Service

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Enable the FerretDB service to start on boot and then start the service immediately. This command requires root privileges.

```bash
sudo systemctl enable ferretdb
sudo systemctl start ferretdb
```

--------------------------------

### ExaBGP Warning Message Example

Source: https://fastnetmon.com/docs/exabgp_integration

This is an example of a common warning message from ExaBGP regarding a missing configuration environment file. It does not indicate an error and ExaBGP will still start.

```text
exabgp: 1363   configuration environment file missing
exabgp: 1363   configuration generate it using "exabgp --fi > /usr/local/etc/exabgp/exabgp.env"
```

--------------------------------

### ExaBGP Blackhole Configuration Example

Source: https://fastnetmon.com/docs/exabgp_integration

This is an example ExaBGP configuration file. Modify the AS numbers, router IDs, and neighbor IPs to match your network setup.

```exabgp
group Core_v4 {
    hold-time 180;
    # local AS number
    local-as 65001;
    # Remote AS number
    peer-as 1234;
    # ID for this ExaBGP router
    router-id 10.0.3.114;
    graceful-restart 1200;

    # Remote peer
    neighbor 10.0.3.115 {
        # Local IP addess which used for connections to this peer
        local-address 10.0.3.114;
        description "Quagga";
    }

    # Add this line for process management
    process service-dynamic {
        run /usr/bin/socat stdout pipe:/var/run/exabgp.cmd;
    }
}
```

--------------------------------

### Enable and Start MongoDB

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Configures the MongoDB service to start on boot and initiates the service.

```bash
sudo systemctl enable mongod
sudo systemctl start mongod
```

--------------------------------

### Sample Output for Get Banlist

Source: https://fastnetmon.com/docs/fastnetmon.community-api

Example of the output format when retrieving a list of blocked hosts.

```text
192.168.1.1/32
```

--------------------------------

### Retrieve License via API

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Example GET request to fetch license information.

```bash
curl -X GET -u admin:YOU_PASSWORD https://127.0.0.1:10007/license
```

--------------------------------

### Install MongoDB Server and Clients

Source: https://fastnetmon.com/docs/mongodb

Installs the necessary MongoDB packages on your system. Ensure you have appropriate permissions.

```bash
apt-get install -y mongodb-server mongodb-clients
```

--------------------------------

### Install ExaBGP using pip

Source: https://fastnetmon.com/docs/quagga-bgp-and-exabgp

Installs the ExaBGP package using pip. Ensure Python and pip are installed.

```bash
pip install exabgp
```

--------------------------------

### Install Graphite Web Frontend

Source: https://fastnetmon.com/docs/graphite_integration

Install the web interface for Graphite to visualize data. This step is required to access the Graphite UI.

```bash
sudo apt-get install -y graphite-web
```

--------------------------------

### Install MongoDB

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Updates package lists and installs the MongoDB server.

```bash
sudo apt-get update
sudo apt-get install -y mongodb-org
```

--------------------------------

### Install Graphic Stack

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-visual-traffic

Use the FastNetMon installer to set up the graphic stack, including Grafana and Clickhouse.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer -install_graphic_stack
```

--------------------------------

### Install FerretDB

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-migration-from-mongodb-to-ferretdb

Download and execute the FastNetMon installer script with the '-ferretdb_only' flag to install FerretDB. Ensure the installer is executable.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer -ferretdb_only
```

--------------------------------

### Install FastNetMon Docker Containers

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-docker-installation

After activating your license, run this command to install Docker engine and all necessary FastNetMon containers. This is part of the automated installation process.

```bash
sudo ./installer -fastnetmon_docker
```

--------------------------------

### Install mail utility

Source: https://fastnetmon.com/docs-fnm-advanced/notify-script-in-bash

Install the bsd-mailx package required for sending email notifications.

```bash
sudo apt-get install -y bsd-mailx
```

--------------------------------

### Install FastNetMon Advanced via CLI

Source: https://fastnetmon.com/docs-fnm-advanced/installing-fastnetmon-advanced-on-google-compute-engine

Downloads and executes the FastNetMon installer script using an activation coupon.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer -activation_coupon your_coupon_from_email
```

--------------------------------

### Install socat

Source: https://fastnetmon.com/docs/exabgp_integration

Install the socat utility, which may be required for ExaBGP communication. Use the appropriate command for your package manager.

```bash
apt-get install -y socat
```

```bash
yum install -y socat
```

--------------------------------

### ExaBGP Configuration Example

Source: https://fastnetmon.com/docs/quagga-bgp-and-exabgp

Example configuration for ExaBGP to announce a static route for blackholing. The 'next-hop' must be the local machine's IP.

```exabgp
group Core_v4 {
    hold-time 180;
    local-as 65001;
    peer-as 1234;
    router-id 10.0.3.114;
    graceful-restart 1200;

    static {
        route 10.10.10.1/32 next-hop 10.0.3.114 community 65001:666;
    }   

    neighbor 10.0.3.115 {
        local-address 10.0.3.114;
        description "Quagga";
    }   
}
```

--------------------------------

### Install FastNetMon on RedHat-based Systems from Local RPM Package

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-upgrade-procedure

For offline installations on RedHat-based systems, download the .rpm package and install it using yum.

```bash
sudo yum install ./fastnetmon.rpm
```

--------------------------------

### Install FastNetMon on Debian/Ubuntu from Local DEB Package

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-upgrade-procedure

For offline installations on Debian and Ubuntu, download the .deb package and install it using dpkg.

```bash
sudo dpkg -i fastnetmon.deb
```

--------------------------------

### API Response Example

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Example JSON output for a successful network list request.

```json
{"success":true,"error_text":"","values":["1.1.1.0/22","2a01:4b00::1"]}
```

--------------------------------

### Install FastNetMon Advanced on ARM64

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-arm-64-edition

Downloads and executes the ARM64 installer script with developer version flags.

```bash
wget https://install.fastnetmon.com/installer_arm64 -Oinstaller
sudo chmod +x installer
sudo ./installer -developer_version
```

--------------------------------

### Configure traffic rule example

Source: https://fastnetmon.com/docs-fnm-advanced/flexible-thresholds

Example configuration for a DNS traffic rule using UDP protocol on port 53.

```bash
sudo fcli set traffic_rule dns protocols udp
sudo fcli set traffic_rule dns active true
sudo fcli set traffic_rule dns source_ports 53
sudo fcli commit
```

--------------------------------

### Install FastNetMon

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Update package lists and install the FastNetMon package.

```bash
sudo apt-get update
sudo apt install -y fastnetmon
```

--------------------------------

### Install PostgreSQL

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Installs the PostgreSQL server and contributed modules on Debian-based systems.

```bash
sudo apt install -y postgresql postgresql-contrib
```

--------------------------------

### Install dependencies and download script

Source: https://fastnetmon.com/docs-fnm-advanced/selective-bgp-blackhole-or-traffic-diversion-in-fastnetmon-advanced

Installs the required Perl JSON library and clones the notification script repository.

```bash
sudo apt-get install -y libjson-perl git
```

```bash
git clone git@github.com:FastNetMon/selective_blackhole_traffic_diversion.git
cd selective_blackhole_traffic_diversion
sudo cp notify_json.pl /usr/local/bin/notify_json.pl
```

--------------------------------

### Install APT HTTPS support

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Install necessary packages to support HTTPS for the FastNetMon repository.

```bash
sudo apt install -y apt-transport-https libssl1.0.0 iproute2
```

--------------------------------

### Install script dependencies

Source: https://fastnetmon.com/docs-fnm-advanced/escalation-script-for-fastnetmon-advanced

Install the required requests library using pip.

```bash
sudo pip install requests
```

--------------------------------

### Install FastNetMon Graphic Stack on ARM64

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-arm-64-edition

Downloads and executes the ARM64 installer script to deploy InfluxDB, Grafana, and Clickhouse.

```bash
wget https://install.fastnetmon.com/installer_arm64 -Oinstaller
sudo chmod +x installer
sudo ./installer -install_graphic_stack
```

--------------------------------

### Start GoBGP Daemon

Source: https://fastnetmon.com/docs/gobgp-integration

Execute the GoBGP daemon using the specified configuration file.

```bash
sudo /opt/fastnetmon.community/libraries/gobgp_3_12_0/gobgpd -f /etc/gobgpd.conf
```

--------------------------------

### Install API dependencies

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-example-api-client

Installs the required python3-requests library on Debian-based systems.

```bash
sudo apt-get install -y python3-requests
```

--------------------------------

### Example Per Interface Counter Output

Source: https://fastnetmon.com/docs-fnm-advanced/per-interface-counters

This is an example of the output you can expect after enabling and viewing per-interface counters. It shows packets and bandwidth in Mbps for different interfaces.

```text
10.1.2.1_27    in packets: 33678 out packets: 14026 in mbps: 332 out mbps: 19
10.1.2.1_64    in packets: 15536 out packets: 4337 in mbps: 153 out mbps: 5
10.1.2.1_31    in packets: 32950 out packets: 87125 in mbps: 43 out mbps: 830
```

--------------------------------

### FastNetMon Advanced Configuration Example

Source: https://fastnetmon.com/docs-fnm-advanced

This is an example configuration snippet for FastNetMon Advanced, showing settings for IP blackhole persistence and ClickHouse integration for metrics storage. Ensure ClickHouse is properly configured and accessible.

```ini
[general]
blackhole_persist_during_restart = true

[clickhouse]
host = 127.0.0.1
port = 9000
user = default
password = ""
database = fastnetmon
table = traffic_stats
```

--------------------------------

### Example Blackhole Output

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-bgp-blackhole-automation

This is an example of the output when querying details for a blackholed IP address.

```text
IP:			10.0.10.1
UUID:			41799e15-8fa7-4b56-b3d6-840db3fcb956
Hostgroup:		global
Host Network:		10.0.10.1/22
Detection Source:	manual
Detection Threshold:	unknown
Detection Direction:	unknown
```

--------------------------------

### Install Quagga Package

Source: https://fastnetmon.com/docs/quagga-bgp-and-exabgp

Installs the Quagga routing software package using apt-get. Requires root privileges.

```bash
apt-get install -y quagga
```

--------------------------------

### Start FastNetMon Services

Source: https://fastnetmon.com/docs/fastnetmon-community-docker-install

Launch the FastNetMon daemon and client inside the running container.

```bash
fastnetmon &
fastnetmon_client
```

--------------------------------

### Manage PostgreSQL Service

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Commands to enable and start the PostgreSQL service.

```bash
sudo systemctl enable postgresql
```

```bash
sudo systemctl start postgresql
```

--------------------------------

### Prepare Log Directories and Files

Source: https://fastnetmon.com/docs/fastnetmon-community-docker-install

Create the necessary log files and directories on the host to ensure persistence outside the container.

```bash
touch /var/log/fastnetmon.log
chmod 0644 /var/log/fastnetmon.log

mkdir /var/log/fastnetmon_attacks
chmod 0700 /var/log/fastnetmon_attacks
```

--------------------------------

### Quagga BGP Configuration Example

Source: https://fastnetmon.com/docs/quagga-bgp-and-exabgp

Example configuration for Quagga's BGP daemon. Note: This is not suitable for production environments and includes debug options.

```quagga
hostname SoftBGP
password zebra987
enable password zebra987
log file /var/log/quagga/bgpd.log

debug bgp events
debug bgp filters
debug bgp fsm
debug bgp keepalives
debug bgp updates

router bgp 1234
bgp router-id 10.0.3.115
bgp log-neighbor-changes

neighbor 10.0.3.114 remote-as 65001
```

--------------------------------

### Initialize Host System Files

Source: https://fastnetmon.com/docs/fastnetmon-community-docker-install

Create required directories, files, and scripts on the host system before launching the linked container.

```bash
mkdir /usr/local/fastnetmon
touch /var/log/fastnetmon_attacks /var/log/fastnetmon.log /etc/networks_list /etc/networks_whitelist /etc/fastnetmon.conf /etc/exabgp_blackhole.conf/var/log/fastnetmon-notify.log

cp /etc/fastnetmon.conf /etc/fastnetmon.conf.bkp
cp /usr/local/fastnetmon/fastnetmon_notify.py /usr/local/fastnetmon/fastnetmon_notify.py.bkpwget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/scripts/fastnetmon_notify.py -O /usr/local/fastnetmon/fastnetmon_notify.py 

chmod +x /usr/local/fastnetmon/fastnetmon_notify.py 
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon.conf -O /etc/fastnetmon.conf
```

--------------------------------

### Import Community Edition Configuration to Advanced

Source: https://fastnetmon.com/docs-fnm-advanced/migration-from-community-edition-to-advanced

Use this command to download the installer and import your existing FastNetMon Community configuration into the Advanced Edition. Ensure you have installed the Advanced version first and consider backing up your current configuration.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer -import_community_edition_configuration
```

--------------------------------

### Create Configuration

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Initializes the FastNetMon configuration.

```bash
sudo fcli create_configuration
```

--------------------------------

### FastNetMon API Client Output Example

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-example-api-client-which-blocks-and-unblocks-ip

This is an example of the expected output when the FastNetMon API client script runs successfully, indicating IP blackholing and removal.

```text
Blackhole IP: 127.0.0.197
Correctly blackholed IP
Wait 5 second to propagate changes
Correctly found UUID for this IP 2518758c-a751-4984-9aeb-c5a935422e91
Correctly removed blackhole announce
```

--------------------------------

### Example API Client for Blocking/Unblocking IPs

Source: https://fastnetmon.com/docs-fnm-advanced

This Python script demonstrates how to interact with the FastNetMon API to block and unblock IP addresses. Ensure you have the 'requests' library installed and replace placeholder API credentials with your actual ones.

```python
import requests

API_HOST = "http://127.0.0.1:8080"
API_KEY = "YOUR_API_KEY"

def block_ip(ip):
    url = f"{API_HOST}/api/v1/ban/{ip}"
    headers = {
        "X-Api-Key": API_KEY
    }
    response = requests.post(url, headers=headers)
    if response.status_code == 200:
        print(f"Successfully blocked {ip}")
    else:
        print(f"Failed to block {ip}: {response.text}")

def unblock_ip(ip):
    url = f"{API_HOST}/api/v1/ban/{ip}"
    headers = {
        "X-Api-Key": API_KEY
    }
    response = requests.delete(url, headers=headers)
    if response.status_code == 200:
        print(f"Successfully unblocked {ip}")
    else:
        print(f"Failed to unblock {ip}: {response.text}")

if __name__ == "__main__":
    test_ip = "192.168.1.100"
    block_ip(test_ip)
    # Wait for some time or perform other operations
    unblock_ip(test_ip)
```

--------------------------------

### API String Value Response

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Example response for a string configuration value.

```bash
curl -X GET -u apiuser:securepass9 https://127.0.0.1:10007/main/sflow_host
{"success":true,"error_text":"","value":"94.76.167.202"}
```

--------------------------------

### Initialize and Apply FastNetMon Configuration

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Commands to create the default configuration, verify it, and apply changes.

```bash
sudo fcli create_configuration
```

```bash
sudo fcli show main
```

```bash
sudo fcli commit
```

--------------------------------

### Launch FastNetMon with Custom Configuration

Source: https://fastnetmon.com/docs/multipe_instances

Start FastNetMon instances using the '--configuration_file' argument to specify a unique configuration for each. Use '--daemonize' to run them in the background.

```bash
./fastnetmon --configuration_file=/etc/fastnetmon_mayflower.conf --daemonize
```

```bash
./fastnetmon --configuration_file=/etc/fastnetmon_hetzner.conf --daemonize
```

--------------------------------

### Run FastNetMon CLI

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-docker-installation

The installer tool places the fcli binary on the host machine. Use this command to interact with FastNetMon from the host.

```bash
sudo fcli
```

--------------------------------

### Download Configuration File

Source: https://fastnetmon.com/docs/fastnetmon-community-docker-install

Fetch the default configuration file from the official repository.

```bash
wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon.conf -O /etc/fastnetmon.conf
```

--------------------------------

### Initialize Database and Permissions

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Creates the ferretdb database with specific locale settings and grants necessary schema creation permissions.

```bash
sudo -u postgres createdb ferretdb --locale=en_US.UTF-8 --template=template0
```

```bash
sudo -u postgres psql -c "GRANT CREATE ON DATABASE ferretdb TO fastnetmon_user;"
```

--------------------------------

### Create Keychain Directory

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-manual-install-process

Sets up a secure directory for storing database credentials.

```bash
sudo mkdir -p /etc/fastnetmon/keychain
sudo chmod 700 /etc/fastnetmon/keychain
```

--------------------------------

### GET /license

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Retrieve license information using a GET request.

```APIDOC
## GET /license

### Description
Retrieves the license details for FastNetMon.

### Method
GET

### Endpoint
`https://127.0.0.1:10007/license`

### Parameters
#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
curl -X GET -u admin:YOU_PASSWORD https://127.0.0.1:10007/license
```

### Response
#### Success Response (200)
Returns license information.

#### Response Example
(Example response structure not provided in source text, but typically includes license details.)
```

--------------------------------

### Verify sFlow configuration output

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-configuration-with-huawei-sflow-v5

Example output showing the sFlow configuration details.

```text
sFlow Version 5 Information:
--------------------------------------------------------------------------
Collector Information:

   Collector ID: 1
     IP Address: 10.0.0.1
 Address family: IPV4
   Vpn-instance: NA
           Port: 6343
  Datagram size: 1400
       Time out: NA
    Description: NA
--------------------------------------------------------------------------
Port on slot 0 Information:

Interface: 40GE0/0/2
 Flow-sample collector: 1            Counter-sample collector  : 1
 Flow-sample rate(1/x): 256          Counter-sample interval(s): 10
 Flow-sample maxheader: 256
 Flow-sample direction: IN,OUT
```

--------------------------------

### Install InfluxDB Python dependency

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-naseline-calculation

Install the required Python library to interact with InfluxDB.

```bash
sudo pip3 install influxdb
```

--------------------------------

### BGP Instance Print Output

Source: https://fastnetmon.com/docs-fnm-advanced/mikrotik-bgp-configuration

Example output showing the status of the BGP instance.

```text
Flags: * - default, X - disabled 
 0 *  name="default" as=65001 router-id=0.0.0.0 redistribute-connected=no redistribute-static=no redistribute-rip=no redistribute-ospf=no redistribute-other-bgp=no 
      out-filter="" client-to-client-reflection=yes ignore-as-path-len=no routing-table=""
```

--------------------------------

### Run FastNetMon Container

Source: https://fastnetmon.com/docs/fastnetmon-community-docker-install

Start the container with volume mappings for configuration and logs, and port mappings for IPFIX traffic.

```bash
docker run -a stdin -a stdout -i \
-v /var/log/fastnetmon_attacks:/var/log/fastnetmon_attacks \
-v /var/log/fastnetmon.log:/var/log/fastnetmon.log \
-v /etc/networks_list:/etc/networks_list \
-v /etc/networks_whitelist:/etc/networks_whitelist \
-v /etc/fastnetmon.conf:/etc/fastnetmon.conf \
-p IPFIX1:2055:2055/udp \
-p IPFIX2:2055:2055/udp \
-t fastnetmon /bin/bash
```

--------------------------------

### Install Perl JSON library

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-notify-script-in-perl

Install the necessary dependency for processing JSON data in Perl.

```bash
sudo apt-get install -y libjson-perl
```

--------------------------------

### Enable UDP PPS threshold for global hostgroup

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-threshold-types

Example demonstrating how to enable and commit a UDP packets per second threshold for the global hostgroup.

```bash
sudo fcli set hostgroup global ban_for_udp_pps true
sudo fcli set hostgroup global threshold_udp_pps 1000
sudo fcli commit
```

--------------------------------

### Install Build Dependencies for samplicator

Source: https://fastnetmon.com/docs-fnm-advanced/sflow-netflow-or-ipfix-duplication-to-multiple-servers

Installs necessary packages for building the samplicator tool on Debian/Ubuntu systems.

```bash
sudo apt-get install -y automake gcc
```

--------------------------------

### List All Networks

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Retrieve the list of configured networks.

```bash
curl -q -X GET -u admin:admin 'https://127.0.0.1:10007/main/networks_list'
```

--------------------------------

### API error response example

Source: https://fastnetmon.com/docs-fnm-advanced/hostgroup-max-talkers-capability

Example of a 500 Internal Server Error response when data is missing.

```text
[martini]2024/04/12 15:45:56 Completed GET /hostgroup_max_talkers/2023-04-12T31:44:38Z 500 Internal Server Error in 7.135398ms
[martini]2024/04/12 15:45:56 Show function returned error: We do not have any samples for your query
```

--------------------------------

### Import configuration from filesystem

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Imports a configuration file from the filesystem.

```bash
curl --user "admin:password" -X PUT http://127.0.0.1:10007/import_configuration/%2ftmp%2fdump.tar
{"success":true,"error_text":""}
```

--------------------------------

### Install FerretDB

Source: https://fastnetmon.com/docs-fnm-advanced/using-fastnetmon-advanced-with-ferretdb-and-postgresql-instead-of-mongodb

Install the downloaded FerretDB Debian package using dpkg. This command requires root privileges.

```bash
sudo dpkg -i ferretdb.deb
```

--------------------------------

### Configuration Syntax

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-cli-reference

Standard commands for retrieving, setting, and deleting configuration values.

```bash
show <category> <option>
```

```bash
set <category> <option> <value>
```

```bash
set <category> <option> (disable|enable)
```

```bash
set <category> <option> <new_value>
```

```bash
delete <category> <option> <value_for_remove>
```

```bash
show <category>
```

--------------------------------

### Install ExaBGP 3

Source: https://fastnetmon.com/docs/exabgp_integration

Install ExaBGP version 3.4.20 using pip. This version is recommended for compatibility with FastNetMon.

```bash
pip install exabgp==3.4.20
```

--------------------------------

### Create and Configure a Custom Hostgroup

Source: https://fastnetmon.com/docs-fnm-advanced/per-hostgroup-thresholds

Create a custom hostgroup, set its calculation method to 'total', and assign networks to it. Ensure prefixes are unique across all total hostgroups.

```bash
sudo fcli set hostgroup servers
sudo fcli set hostgroup servers calculation_method total
sudo fcli set hostgroup servers networks 192.168.1.0/24
sudo fcli set hostgroup servers networks 10.10.1.2/16
sudo fcli commit
```

--------------------------------

### API Error Response Example

Source: https://fastnetmon.com/docs-fnm-advanced/hostgroup-traffic-profile-capability

Example of a 500 Internal Server Error when traffic samples are missing for a query.

```text
[martini]2024/04/12 15:45:56 Completed GET /hostgroup_traffic_samples/2023-04-12T31:44:38Z 500 Internal Server Error in 7.135398ms
[martini]2024/04/12 15:45:56 Show function returned error: We do not have any samples for your query
```

--------------------------------

### Attack Status Log Message Example

Source: https://fastnetmon.com/docs-fnm-advanced/log-management-in-fastnetmon

Example log message format for reporting the status of an active attack.

```log
v:1 mode:blackhole action:status proto:ipv4 target: 1.2.3.4 pps_in_rate: 1 pps_out_rate: 2 bytes_in_rate: 3 bytes_out_rate: 4
```

--------------------------------

### Download and prepare the escalation script

Source: https://fastnetmon.com/docs-fnm-advanced/escalation-script-for-fastnetmon-advanced

Commands to fetch the script from GitHub, set execution permissions, and move it to the /opt directory.

```bash
wget https://raw.githubusercontent.com/FastNetMon/blackhole-escalation-script-fastnetmon-advanced/main/escalation_to_bgp_blackhole.py
chmod +x escalation_to_bgp_blackhole.py
sudo cp escalation_to_bgp_blackhole.py /opt
```

--------------------------------

### Start MongoDB Daemon

Source: https://fastnetmon.com/docs-fnm-advanced/mongodb-integration-with-fastnetmon-advanced

Manually start the MongoDB daemon. This is often necessary after disk space issues or unexpected shutdowns.

```bash
sudo systemctl start mongod
```

--------------------------------

### Enter JunOS configuration mode

Source: https://fastnetmon.com/docs-fnm-advanced/junos-bgp-configuration

Switch the JunOS CLI into configuration mode to apply changes.

```text
configure
```

--------------------------------

### FastNetMon Log Entry Examples

Source: https://fastnetmon.com/docs-fnm-advanced/log-management-in-fastnetmon

Examples of log entries generated by FastNetMon, including informational, warning, and error messages.

```log
2020-05-01 19:12:46,252 [INFO] FastNetMon started
2020-05-01 19:12:46,252 [INFO] FastNetMon version: 2.0.187 git 804...631 started
2020-05-01 19:12:46,252 [INFO] Read configuration file
```

```log
2020-04-12 22:31:24,262 [WARN] We will use 192.168.1.0/30 instead of 192.168.1.1/30 because it's host address
2020-03-17 09:40:34,244 [ERROR] Please specify intreface for AF_PACKET
```

--------------------------------

### Enable and Restart Apache Service

Source: https://fastnetmon.com/docs/graphite_integration

Configure Apache to start on boot and restart the service to apply the new configuration.

```bash
sudo systemctl enable apache2.service
sudo systemctl restart apache2.service
```

--------------------------------

### Install Graphite Packages on Debian/Ubuntu

Source: https://fastnetmon.com/docs/graphite_integration

Install necessary packages for Graphite, including the database (whisper) and the data collection daemon (carbon).

```bash
sudo apt-get install -y python-whisper graphite-carbon
```

--------------------------------

### FastNetMon Attack Record Example

Source: https://fastnetmon.com/docs-fnm-advanced/mongodb-integration-with-fastnetmon-advanced

An example of an attack record stored in the MongoDB 'attacks' collection. Note the truncated 'attack_details' for brevity.

```javascript
db.attacks.findOne()
{
    "_id" : ObjectId("5a985f3cec7006077668a321"),
    "ip" : ":0001",
    "attack_details" : {
        "attack_uuid" : "e9ba83bd-389f-4332-8e2e-0300c01c839b",
        "attack_severity" : "middle",
        "attack_type" : "unknown",
                ....
    }
}
```

--------------------------------

### Versioned Log Message Examples

Source: https://fastnetmon.com/docs-fnm-advanced/log-management-in-fastnetmon

Examples of versioned and stable log messages for ban and unban operations, used for automated actions.

```log
v:1 mode:blackhole action:ban proto:ipv4 target:127.0.0.1 pps_in_rate:0 pps_out_rate:0 bytes_in_rate:0 bytes_out_rate:0
```

```log
v:1 mode:blackhole action:unban proto:ipv4 target:127.0.0.1 pps_in_rate:0 pps_out_rate:0 bytes_in_rate:0 bytes_out_rate:0
```

--------------------------------

### Download and Install hsflowd

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-sflow-v5-export-from-linux

Download the latest binary for your Linux distribution and install it using dpkg. Ensure your kernel version is 3.19 or newer.

```bash
wget https://github.com/sflow/host-sflow/releases/download/.....deb
sudo dpkg -i hsflowd...amd64.deb
```

--------------------------------

### Configure API Credentials and Host

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Set the login, password, port, and host for the API daemon.

```bash
sudo fcli set main web_api_login admin
sudo fcli set main web_api_password your_password_replace_it
sudo fcli set main web_api_port 10007
sudo fcli set main web_api_host 127.0.0.1
```

--------------------------------

### Import Disk Image to Proxmox

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-installation-on-proxmox-vm

Import the downloaded QCOW2 file into the local LVM storage for the VM.

```bash
sudo qm importdisk  fastnetmon-ubuntu-22.04-amd64-2.0.360.0.qcow2 local-lvm
```

--------------------------------

### Reload Dictionaries and Start FastNetMon

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-configuration-for-netflow-and-ipfix

After clearing the cache, reload the ASN database and restart the FastNetMon service. This ensures the service starts with a clean configuration.

```bash
sudo fill_dictionaries
sudo systemctl start fastnetmon
```

--------------------------------

### Verify Interface Configuration

Source: https://fastnetmon.com/docs-fnm-advanced/junos_integration

Display the current interface settings in standard and set formats.

```text
r1# show interfaces ge-1/0/4  
unit 0 {
    description netflow-collector;
    family inet {
        address 10.50.1.1/30;
    }
}

r1# show interfaces ge-1/0/4 | display set 
set interfaces ge-1/0/4 unit 0 description netflow-collector
set interfaces ge-1/0/4 unit 0 family inet address 10.50.1.1/30
```

--------------------------------

### Example Clickhouse table size output

Source: https://fastnetmon.com/docs-fnm-advanced/clickhouse-excessive-disk-usage-with-log-tables

Sample output showing disk usage distribution across system and fastnetmon databases.

```text
┌─database───┬─table───────────────────┬─size───────┐
│ system     │ trace_log               │ 32.84 GiB  │
│ system     │ part_log                │ 26.51 GiB  │
│ system     │ metric_log              │ 2.83 GiB   │
│ system     │ asynchronous_metric_log │ 2.80 GiB   │
│ fastnetmon │ host_metrics            │ 664.83 MiB │
│ fastnetmon │ host_metrics_ipv6       │ 34.97 MiB  │
│ fastnetmon │ total_metrics_ipv6      │ 6.87 MiB   │
│ fastnetmon │ network_metrics_ipv6    │ 5.14 MiB   │
│ fastnetmon │ asn_metrics_ipv4        │ 4.31 MiB   │
│ fastnetmon │ network_metrics         │ 4.13 MiB   │
│ fastnetmon │ asn_metrics_ipv6        │ 3.18 MiB   │
│ fastnetmon │ total_metrics           │ 2.60 MiB   │
│ system     │ query_log               │ 13.95 KiB  │
│ system     │ crash_log               │ 2.14 KiB   │
```

--------------------------------

### Example Socket Statistics Output

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-port-mirror-configuration

Example output showing the number of received and dropped packets for AF_PACKET sockets. This is used for debugging performance issues.

```text
socket_received_packets                  0 
socket_dropped_packets                   0 
```

--------------------------------

### Enable sFlow and Configure Global Settings

Source: https://fastnetmon.com/docs-fnm-advanced/sflow-configuration-on-cisco-nexus-9000-for-fastnetmon-advanced

Enable the sFlow feature and set global parameters such as sampling rate, maximum sampled size, and collector details. Ensure the sampling rate is appropriate for your hardware.

```bash
feature sflow
sflow sampling-rate 4096
sflow max-sampled-size 128
sflow counter-poll-interval 20
sflow max-datagram-size  1400
sflow counter-poll-interval 30
sflow collector-ip  vrf default
sflow collector-port 6343
sflow agent-ip 
```

--------------------------------

### Install FRR

Source: https://fastnetmon.com/docs-fnm-advanced/frr-bgp-configuration-with-fastnetmon

Update the package list and install FRR and FRR Python tools. This command ensures you have the latest FRR version available from the added repository.

```bash
sudo apt update 
sudo apt install -y frr frr-pythontools
```

--------------------------------

### Initialize Graphite Database

Source: https://fastnetmon.com/docs/graphite_integration

Run the database synchronization command to create the necessary database tables and user accounts. You will be prompted to set a password and email.

```bash
sudo graphite-manage syncdb
```

--------------------------------

### Install Clang 17 and Libbpf-dev

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-xdp-filter

Install clang 17 and libbpf-dev required for FastNetMon's XDP filtering. Ensure your system is Ubuntu 22.04 LTS.

```bash
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc

echo -e "deb https://apt.llvm.org/jammy/ llvm-toolchain-jammy-17 main\n" | sudo tee -a /etc/apt/sources.list.d/clang.list
sudo apt-get update 
sudo apt-get install -y clang-17 libbpf-dev
```

--------------------------------

### Verify global sFlow slot output

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-configuration-with-huawei-sflow-v5

Example output for the global sFlow slot configuration command.

```text
sFlow Version 5 Information:
--------------------------------------------------------------------------
Collector Information:

   Collector ID: 1
     IP Address: 10.0.0.1
 Address family: IPV4
   Vpn-instance: NA
           Port: 6343
  Datagram size: 1400
       Time out: NA
    Description: NA
```

--------------------------------

### Execute baseline script

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-naseline-calculation

Run the script to analyze host metrics and determine traffic thresholds.

```bash
python3 influxdb_baseline.py
```

--------------------------------

### Upgrade FastNetMon Advanced using Installer Script

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-advanced-upgrade-procedure

Use this script to upgrade FastNetMon Advanced on any supported Linux distribution. Ensure you have execute permissions for the downloaded installer.

```bash
wget https://install.fastnetmon.com/installer -Oinstaller
sudo chmod +x installer
sudo ./installer -upgrade_fastnetmon_advanced
```

--------------------------------

### Enable FastNetMon SSH Shell Auto Start

Source: https://fastnetmon.com/docs-fnm-advanced/fastnetmon-ssh-shell

Enable the FastNetMon SSH shell service to automatically start on system boot. This ensures the service is available after a reboot.

```bash
sudo systemctl enable fastnetmon_ssh_shell
```

--------------------------------

### MongoDB Client Connection Log Example

Source: https://fastnetmon.com/docs-fnm-advanced/mongodb-integration-with-fastnetmon-advanced

Example log entries showing client metadata being logged by MongoDB, even when verbosity is reduced. This indicates specific connection events are still logged.

```json
{"t":{"$date":"2024-03-06T15:39:51.328+00:00"},"s":"I",  "c":"-",        "id":20883,   "ctx":"conn11","msg":"Interrupted operation as its client disconnected","attr":{"opId":23223}}
{"t":{"$date":"2024-03-06T15:39:51.772+00:00"},"s":"I",  "c":"NETWORK",  "id":51800,   "ctx":"conn14","msg":"client metadata","attr":{"remote":"127.0.0.1:55784","client":"conn14","doc":{"driver":{"name":"mongo-go-driver","version":"v1.12.1"},"os":{"type":"linux","architecture":"amd64"},"platform":"go1.18.1"}}}
{"t":{"$date":"2024-03-06T15:39:51.772+00:00"},"s":"I",  "c":"NETWORK",  "id":51800,   "ctx":"conn13","msg":"client metadata","attr":{"remote":"127.0.0.1:55782","client":"conn13","doc":{"driver":{"name":"mongo-go-driver","version":"v1.12.1"},"os":{"type":"linux","architecture":"amd64"},"platform":"go1.18.1"}}}
{"t":{"$date":"2024-03-06T15:39:51.773+00:00"},"s":"I",  "c":"NETWORK",  "id":51800,   "ctx":"conn15","msg":"client metadata","attr":{"remote":"127.0.0.1:55796","client":"conn15","doc":{"driver":{"name":"mongo-go-driver","version":"v1.12.1"},"os":{"type":"linux","architecture":"amd64"},"platform":"go1.18.1"}}}
```

--------------------------------

### Get Main Configuration Fields

Source: https://fastnetmon.com/docs-fnm-advanced/advanced-api

Use this command to retrieve detailed information about all configurable fields for the main configuration. This includes field names, types, descriptions, and categories.

```bash
curl -s -X GET -u admin:your_password_replace_it https://127.0.0.1:10007/fields/main
```

--------------------------------

### Enable sFlow on Interface

Source: https://fastnetmon.com/docs-fnm-advanced/cisco-asr-9000-sflow-configuration-for-fastnetmon-advanced

Applies the monitor and sampler maps to a specific interface. Replace TenGigE0/X/X/X with the target interface identifier.

```text

interface TenGigE0/X/X/X
flow datalinkframesection monitor SFLOW-MON-MAP sampler SFLOW-SAMP-MAP ingress
```

--------------------------------

### Country Lockdown Script Output Example

Source: https://fastnetmon.com/docs-fnm-advanced/country-lockdown-capability

This is an example of the output generated when the country lockdown script is executed. It shows the loaded GeoIP file, BGP configuration, and the prefixes being announced for the blocked country.

```text
./country_lockdown
2023/06/30 18:13:44 Loaded GeoIP file: {BinaryFormatMajorVersion:2 BinaryFormatMinorVersion:0 BuildEpoch:1687446147 DatabaseType:GeoIP2-Country Description:map[en:GeoIP2 Country database] IPVersion:6 Languages:[de en es fr ja pt-BR ru zh-CN] NodeCount:977873 RecordSize:24}
2023/06/30 18:13:44 GeoIP database has correct format
2023/06/30 18:13:44 Will use next hop: 10.0.0.1
2023/06/30 18:13:44 We have 1 countries in country block list
2023/06/30 18:13:44 Loading prefixes for country code: TV
2023/06/30 18:13:47 Successfully loaded 41 prefixes which belong to this country
2023/06/30 18:13:47 Country prefixes: [5.62.56.241/32 5.62.56.242/31 5.62.58.221/32 5.62.58.222/31 14.137.42.0/24 31.42.183.228/32 45.11.240.128/26 45.42.220.0/24 45.138.10.36/30 57.70.170.0/23 57.71.64.0/20 104.28.13.128/31 104.28.13.130/32 104.28.29.83/32 104.28.29.84/32 104.28.35.98/31 104.28.72.30/31 104.28.90.84/31 104.28.125.92/31 104.28.220.236/30 104.28.220.240/31 104.28.252.236/30 104.28.252.240/31 104.167.192.0/24 136.23.10.195/32 136.23.21.19/32 140.248.20.22/31 146.75.136.22/31 146.75.160.154/31 146.75.190.28/31 172.225.62.192/27 172.225.231.96/28 172.225.245.32/28 194.50.99.228/32 194.50.111.228/32 196.48.196.0/24 196.56.196.0/24 196.197.196.0/24 196.198.196.0/24 196.199.196.0/24 202.2.96.0/19]
2023/06/30 18:13:47 We have 1 entries in allow list
2023/06/30 18:13:47 Allow list: [202.2.96.2]
2023/06/30 18:13:47 We have 2 communities in configuration
2023/06/30 18:13:47 53 prefixes to block

```

--------------------------------

### Build and run tests

Source: https://fastnetmon.com/docs/fastnetmon-community-fine-tuning

Enables the test suite during the build process and executes the resulting test binary.

```bash
cmake -DBUILD_TESTS=ON ..
./fastnetmon_tests
```
Tokens:
Raw