DDoS detection on Linux: from zero
to protected in 10 minutes

Back to Blog

What DDoS Detection Actually Means on Linux

DDoS detection on Linux means monitoring the network traffic hitting your server and identifying when that traffic looks like an attack rather than legitimate use. You're looking for anomalies: sudden spikes in packets per second, unusual protocol distributions, traffic from thousands of source IPs you've never seen before, or known attack patterns like DNS amplification or SYN floods.

There are two tiers of detection you can set up on a Linux server:

Tier 1: Manual investigation. Tools like NetHawk or tcpdump that you run when you suspect a problem. You SSH in, start the tool, and look at what's happening. Good for ad-hoc troubleshooting. Not useful if the attack happens at 4 AM.

Tier 2: Continuous monitoring with alerts. An agent that runs as a service, monitors traffic 24/7, builds baselines, detects anomalies automatically, and sends alerts to Slack, Discord, email, or PagerDuty. This is what you need for production servers.

This guide covers both tiers.

Tier 1: Quick Investigation with NetHawk

If you just want to see what's hitting your server right now, install NetHawk. It's a free, open-source Go binary that shows real-time traffic analysis with attack classification.

# Install (one-liner, Linux/macOS)
curl -sSfL https://raw.githubusercontent.com/Flowtriq/nethawk/main/install.sh | sudo sh

# Run
sudo nethawk

You'll immediately see bandwidth, PPS, protocol breakdown, top source IPs, top destination ports, and attack classification. If you're under a DNS amplification attack, NetHawk will tell you it's DNS amplification, show you the severity level, and rank the source IPs.

For JSON output you can pipe to other tools:

sudo nethawk -json | jq '.severity'

NetHawk is a diagnostic tool. It doesn't run in the background, it doesn't alert anyone, and it doesn't mitigate attacks. Use it when you need to investigate a specific server. For continuous monitoring, you need Tier 2.

Tier 2: Continuous Detection with Flowtriq Agent

The Flowtriq agent (ftagent) runs as a systemd service on your Linux server. It captures packets from the network interface, analyzes traffic patterns, builds per-node baselines, detects attacks, classifies the vector, and optionally deploys automated mitigation.

Step 1: Create a Flowtriq account

Sign up at flowtriq.com/signup. The 14-day trial is fully featured, no credit card required.

Step 2: Add your server in the dashboard

Go to Nodes, click "Add Node," enter your server's name and IP. The dashboard gives you an install command with your unique API key baked in.

Step 3: Install the agent

# The dashboard gives you a one-line install command:
curl -sS 'https://flowtriq.com/api/install.sh?key=YOUR_API_KEY&node=YOUR_NODE_UUID' | sudo bash

This installs ftagent as a systemd service. It starts automatically and survives reboots. The agent is a single Python process that typically uses less than 50 MB of RAM and negligible CPU.

Check that it's running:

sudo systemctl status ftagent

Step 4: Configure alerts

In the Flowtriq dashboard, go to Settings and add notification channels. Supported channels:

• Slack (webhook URL)
• Discord (webhook URL)
• Email
• PagerDuty (integration key)
• Telegram (bot token + chat ID)
• Microsoft Teams (webhook URL)
• Generic webhook (any URL, receives JSON payload)

Send a test alert to verify delivery. You're done.

Step 5: Wait (or don't)

The agent starts building a traffic baseline immediately. Within a few hours, it has a reasonable model of your server's normal traffic. Within a few days, it accounts for daily and weekly patterns. Any significant deviation triggers detection.

If you want to verify detection works without waiting for a real attack, the dashboard shows a live traffic view for each node. You can see current PPS, BPS, and protocol distribution to confirm the agent is capturing data correctly.

What Happens When an Attack is Detected

When ftagent detects anomalous traffic that exceeds the baseline, here's the sequence:

1. Classification. The agent identifies the attack family (UDP flood, SYN flood, etc.) and subtype (DNS amplification, NTP amplification, etc.) based on protocol analysis and port distribution.
2. Alert. Notifications fire to all configured channels within seconds. The alert includes the attack vector, severity, current PPS/BPS, top source IPs, and targeted ports.
3. Mitigation (if configured). Depending on your setup, the agent can automatically deploy iptables/nftables rules to drop attack traffic at the kernel level. For larger attacks, Flowtriq can push BGP FlowSpec rules to your router or trigger upstream scrubbing.
4. PCAP capture. The agent captures packet data during the incident for post-attack forensics.
5. Resolution. When attack traffic subsides and traffic returns to baseline, the incident is marked resolved. Mitigation rules are cleaned up. A summary alert is sent.

Bonus: Adding Flow-Based Detection

If you run your own router (VyOS, Juniper, Mikrotik, Cisco), you can also send NetFlow, sFlow, or IPFIX data to the Flowtriq agent. This gives you network-level visibility in addition to per-server detection. The agent listens for flow records and correlates them with its packet-level analysis.

# In the dashboard, go to the node's Flow Config tab
# Configure your router to export IPFIX/NetFlow to the agent's IP on port 4739
# Example for VyOS:
set system flow-accounting interface eth0
set system flow-accounting netflow version 9
set system flow-accounting netflow server [AGENT_IP] port 4739

Flow-based detection is complementary, not a replacement. It gives you visibility into traffic that the agent might not see (traffic filtered upstream, traffic to other IPs behind the same router). The two detection methods reinforce each other.

Supported Linux Distributions

The Flowtriq agent runs on any Linux distribution with Python 3.8+ and libpcap. Tested and supported:

• Ubuntu 20.04, 22.04, 24.04
• Debian 11, 12
• RHEL / CentOS / AlmaLinux / Rocky Linux 8, 9
• Fedora 38+
• Arch Linux
• Alpine Linux (container deployments)

It also runs on Proxmox VE (as an LXC container using the Proxmox helper script), Docker (using host network mode), and Kubernetes (as a DaemonSet).

NetHawk runs on Linux and macOS. It's a single static Go binary with no runtime dependencies beyond libpcap.

Back to Blog

Related Articles