Pavel Odintsov

In first part of this series I covered such well known protocols as Netflow v5, Netflow v9 and IPFIX. In this article I'll continue conversation and will talk about protocols which offer more flexibility: * sFlow v5 * Port mirror * Sampled port mirror * Sampled port mirror over GRE * Raw headers

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. Please note that this article will be focused only on traffic telemetry protocols which are able to export information about

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. This blog post is result of research and cooperation on this matter with Blažej Krajňák. Netflow and IPFIX for DDoS

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. In this article we’re going to discuss how BGP Flow Spec protocol can allow you to mitigate volumetric DDoS

Hello! I’m Pavel and I’m CTO and co-founder of FastNetMon LTD, London, 🇬🇧. We’re cyber security software vendor and we develop DDoS 🎯 detection and mitigation platform for Telecoms. To detect DDoS attack we need to get information about observed traffic from network equipment first. Our customers use variety

FastNetMon project was built on very basic software engineering principle: don't be a black box 📦 You can see this approach on all levels of our product: * Open source core published at GitHub * Strong preference of RFC approved protocols: BGP Unicast, BGP Flow Spec, IPFIX, sFlow * Multiple options for

Introduction Since XDP (eXpress Data Path) emerged as technology in mainline Linux around 2017 I heard large number of misconceptions and misunderstandings about it's purpose and capabilities. It's very hard to blame anybody for it as amount of high quality materials about this amazing technology is

Setting expectations After reading this article you will have high level understanding of best approaches for developing high performance user space Linux applications which work with live network traffic. Keywords We will talk a lot about following technologies (in historical order as author worked with them): pcap, PF_RING, Netmap,

Want to be among leading engineers testing IPv6 protocol by switching off IPv4 completely for your work laptop? But scared by inability to use IPv4 only services such as GitHub? I can recommend solution for it. We can use some protocol trickery to transparently "upgrade" all IPv4 connections

There are multiple traffic telemetry protocols available from vendors and each of them has their own cons and pros. In this article we will focus on the most advanced one called IPFIX. It's a standardized vendor neutral protocol which offers ways to export almost all possible characteristics and