Setting attack detection thresholds

[Rob]

We're a small business only ISP that offers connection speeds from 10Mbps (for out of band management mainly) up to multi-gig. Our network is comprised of 21500 IP's split across six ranges (/19 x 1, /20 x 2 and /21 x3). IP's blocks are assigned as requested by customers, so as small as a few /30's and a few customers with /23's and everything in between.

How do I make sure I set thresholds that either don't miss attacks on large bandwidth customers or falsely tag traffic for small customers? I've added the IP ranges to FastNetMon as their supernets, but do I need to do add each range individually?

I've been running FNM for about a week now and I'm loving the traffic visibility, and the next step is enabling blackholing and flow spec. 

[Rob]

Would the best approach be grouping subnets into hostgroups that reflect their traffic commits?

[Frank Bulk]

Yes, that's what we do -- we have a default group, and then 2 Gbps, 3 Gbps, and large hostgroups, and put those certain hosts in the appropriately sized host-group.

Frank

--
Follow us on social media: Twitter: https://twitter.com/fastnetmon | Facebook: https://www.facebook.com/fastnetmon/ | LinkedIn: https://www.linkedin.com/company/fastnetmon/
---
You received this message because you are subscribed to the Google Groups "FastNetMon user group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fastnetmon+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/fastnetmon/c98f4ba5-93d2-474c-bf49-bc9fc9ef1078n%40googlegroups.com.

[Rob]

Thanks Frank. I assume you're putting the exact subnet into the host group?

Rob

[Frank Bulk]

Yes, that’s right.

Frank

To view this discussion visit https://groups.google.com/d/msgid/fastnetmon/9c75f4eb-f7be-4446-bb4a-ac86f15ff47cn%40googlegroups.com.