In order to run fastnetmon can be installed via automatic script installer:
[code]wget https://raw.githubusercontent.com/pavel-odintsov/fastnetmon/master/src/fastnetmon_install.pl -Ofastnetmon_install.pl [/code]
Run the downloaded script:
[code] sudo perl fastnetmon_install.pl [/code]
If not need to share the OS version youn are installing the fastnetmon add at the end of the command
[code] –do-not-track-me [/code]
If you need to start the fastnetmon process you can use this command:
[code] /opt/fastnetmon/fastnetmon [/code]
or you can run this process in the backgroung adding a “&” at the end of the command
[code] /opt/fastnetmon/fastnetmon & [/code]
In another console in the same machine start the client process:
[code] /opt/fastnetmon/fastnetmon_client [/code]
To enable fastnetmon to start on server startup, please add the following line to /etc/rc.local:
[code] /opt/fastnetmon/fastnetmon –daemonize [/code]
If something goes wrong you can check the following log file:
[code]tail -f /var/log/fastnetmon.log [/code]
When an incoming or outgoing attack occurs, the program calls a bash script twice (if it exists):
[code] /usr/local/bin/notify_about_attack.sh [/code]
The first time when threshold exceed (at this step we know IP, direction and power of attack). Second when we collect 100 packets for detailed audit of what happened.A sample script is provided and can be installed as follows:
[code] cp /usr/src/fastnetmon/src/notify_about_attack.sh /usr/local/bin/notify_about_attack.sh [/code]
[code] chmod 755 /usr/local/bin/notify_about_attack.sh[/code]
After copying the file, you need to open it and configure the ’email_notify’ option as required.
After installing fastnetmon open the following file:
[code] nano /etc/fastnetmon.conf [/code]
Uncoment and edit the following lines:
[code]graphite = on
graphite_host = 127.0.0.1
graphite_port = 2003
graphite_prefix = fastnetmon [/code]
Install the following packages:
[code] apt-get install -y python-whisper graphite-carbon[/code]
Next install web frontend
[code]apt-get install -y graphite-web[/code]
Create database, specify login/password and email here:
[code]graphite-manage syncdb[/code]
Specify your timezone in file /etc/graphite/local_settings.py on line TIME_ZONE.
[code]nano /etc/graphite/local_settings.py[/code]
Change owner:
[code]chown _graphite:_graphite /var/lib/graphite/graphite.db[/code]
Install and confgiure apache
[code]apt-get install -y apache2 libapache2-mod-wsgi[/code]
[code]cp /usr/share/graphite-web/apache2-graphite.conf /etc/apache2/sites-
available/graphite-web.conf[/code]
[code]a2dissite 000-default.conf[/code]
[code]a2ensite graphite-web[/code]
[code]a2enmod wsgi[/code]
Enable load on startup:
[code]systemctl enable apache2.service[/code]
[code]systemctl restart apache2.service[/code]
For big networks please enlarge number of created file in /etc/carbon/carbon.conf:
[code]MAX_CREATES_PER_MINUTE = 5000[/code]
And if you want to store data every 5 seconds for 1 months please do following
before starting collection to Graphite in file /etc/carbon/storage-schemas.conf:
[code] [default_5sec_for_1month]
pattern = .*
retentions = 5s:31d[/code]