fastnetmon misreports attack type and protocol

[XioNoX]

If you want to solve your issue please read following information below

First of all, please check following steps:

• Do you have latest FastNetMon version? If not, please upgrade to 1.1.3 version.
  We're running 1.1.3
• Do we have similar tickets already? Please check bug tracker and Mailing list about similar issues.
  None than I can find

If it does not help, please fill information below:

• Your operating system name and version?
  Debian 10
• Please attach your /etc/fastnetmon.conf configuration file
  https://github.com/wikimedia/puppet/blob/production/modules/fastnetmon/templates/fastnetmon.conf.erb
• What capture engine are you using: netflow, sflow, miror?
  Netflow

Then please describe your issue as detailed as possible! Thanks you :)

Fastnetmon report some attack as "Attack type: unknown", "Attack protocol: tcp" while it's for example the ICMP pps threshold that is being hit. And all the other values (eg. TCP pps/bandwidth) are well under the limits.
Eg. "Incoming icmp pps: 2020 packets per second".
Before we bumped the threshold in wikimedia/operations-puppet@e7ad32b

This caused us some confusion as we were looking at TCP traffic only at first, based on the report.

We're tracking the issue in https://phabricator.wikimedia.org/T241374 as well.

Thanks!

[pavel-odintsov]

Hello!

Thank you for detailed report! Unfortunately, attack type detection logic in FastNetMon is extremely basic and does not cover full variety of attack types. In many cases it will be unknown.

Protocol detection logic is pretty reliable but it looks only on packets per second:

fastnetmon/src/fastnetmon.cpp

Line 3009 in 50d9706

unsigned int detect_attack_protocol(map_element& speed_element, direction attack_direction) {

So, it does not check which thresholds was hit. When it sees more TCP traffic than other traffic types then it decides that this attack is TCP.

[XioNoX]

Thanks for your quick reply! Are there plans to make it more accurate?

[pavel-odintsov]

Hello!

Sorry, no, we have no plans about it.

[pavel-odintsov]

If you can explain your needs in details we can check possible options!

[XioNoX]

The goal is to make the notification emails accurate, so SREs receiving an email from FastNetMon can quickly identify what triggered it.
We worked around the issue for now by rolling back our per protocols thresholds.

[pavel-odintsov]

Hello!

Thank you for feedback! I've re-tagged ticket as enhancement and we will check what's our options to make it more reliable.