sflow/ddos-protect repository overview

⁠What is ddos-protect?

DDoS Protect⁠ is a real-time distributed denial of service (DDoS) detection and mitigation tool. The software receives a continuous stream of telemetry from standard sFlow agents⁠ embedded in network devices, detects distributed denial of service attacks (DDoS), and pushes BGP remote triggered blackhole and/or Flowspec messages to protect against the attack upstream.

This image also includes sflow-rt/browse-drops⁠, sflow-rt/browse-flows⁠, sflow-rt/browse-metrics⁠, and sflow-rt/prometheus⁠ for exploring metrics.

⁠How to use this image

docker run -v $PWD/store:/sflow-rt/store/ -p 179:1179 -p 6343:6343/udp -p 8008:8008 \
--name sflow-rt -d sflow/ddos-protect -Dddos_protect.router=<IP> -Dddos_protect.as=<ASN>

Access web user interface on port 8008. Configure router to send sFlow to UDP port 6343. Configure router BGP session to connect on port 179.

See sflow/sflow-rt⁠ for additional settings available in the base image.

⁠Documentation and support

Visit sFlow-RT⁠ for documentation, tutorials, and community support.

⁠License

Please read and accept the License Agreement⁠ before downloading this software.