<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I had intended to use the paid version once the 'free trial'
proved to work, but for the previously mentioned reasons it did
not and I gave up. Would still love to have this style of solution
in my network and still open to other solutions, just haven't
really found anything else.</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 1/28/20 2:46 PM, Colton Conor wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAMDdSzPzb0gX_yFmoem_dgt8fzfqCn3+Bw5uQmCAwABwLR0usQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Mike,
<div><br>
</div>
<div>What did you end up going with if not fastnetmon? Were you
using their paid or free version? </div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Dec 5, 2019 at 4:45 PM
Mike <<a href="mailto:mike-nanog@tiedyenetworks.com"
moz-do-not-send="true">mike-nanog@tiedyenetworks.com</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
On 12/5/19 1:43 PM, Hugo Slabbert wrote:<br>
>> FastNetMon is awesome, but its a detection tool with
no mitigation <br>
>> capacity whatsoever.<br>
><br>
> Does is not, though, provide the ability to hook into
RTBH or Flowspec <br>
> setups?<br>
><br>
<br>
Yes it does provide RTBH hook.<br>
<br>
I evaluated fastnetmon using exactly the 'quick setup' and
found it to <br>
have some serious problems with false alarms and statistical
anomalies, <br>
at least when using pure netflow data (did not try sampled
mode). Hosts <br>
that were not in fact receiving >100mbps traffic (a traffic
level I <br>
predetermined as 'attack' for a given network segment), would
<br>
occasionally get flagged as such (and rtbh activated), while 2
real <br>
attacks that came during the testing period (60 days for me)
went <br>
completely unnoticed. Support seemed to concede that sampled
mode is <br>
really the only accurate method, and which by this time I'd
expended all <br>
my interest. Great concept, cool integration, just not ready
for prime time.<br>
<br>
<br>
MIke-<br>
<br>
</blockquote>
</div>
</blockquote>
</body>
</html>