Mirror / SPAN Mode
One SPAN port.
Every IP protected.
Connect a single monitoring server to your switch's SPAN port and detect DDoS attacks targeting any IP in the segment. Independent per-IP baselines, concurrent multi-IP incident tracking, and full protocol classification. The same approach used by FastNetMon, built natively into Flowtriq.
How It Works
Per-IP detection from mirrored traffic.
Configure your switch to mirror traffic from uplink ports to a dedicated monitoring NIC. The FTAgent captures every packet using Linux AF_PACKET with PACKET_FANOUT for multi-thread scaling, parses Ethernet/IP/TCP/UDP headers in real time, and maintains per-destination-IP traffic counters.
Each destination IP gets its own independent baseline using the same sliding-window p99 algorithm as agent mode. When any IP's PPS exceeds its individual threshold, an incident is opened for that specific IP with full protocol classification, source IP analysis, and optional BPF-filtered PCAP capture.
Multiple IPs can be under simultaneous attack with separate incident lifecycles. The dashboard shows a real-time per-IP traffic table with status indicators, baseline/threshold values, and protocol mix breakdowns.
| Capture Backend | AF_PACKET (Linux) or tcpdump fallback |
| Protocols Parsed | IPv4, IPv6, TCP, UDP, ICMP, GRE |
| Frame Types | Ethernet, 802.1Q VLAN, QinQ |
| Max Tracked IPs | 100,000 per window (configurable) |
| Baseline Window | 5 minutes (configurable) |
| Detection Cadence | Every 1 second per IP |
| GRE Decapsulation | Up to 3 layers deep (auto or manual) |
| Subnet Filtering | Optional CIDR-based destination filter |
Monitoring Modes
Three ways to monitor. Pick what fits your network.
Agent Mode
Install the FTAgent on each server. Monitors its own traffic via kernel counters. Best for individual servers and VPS.
Mirror / SPAN Mode
One monitoring server captures mirrored traffic from a switch SPAN port. Per-IP detection across an entire segment. Best for network operators.
Flow Mode
Ingest sFlow, NetFlow, or IPFIX from routers. Sampled upstream visibility without packet capture. Best for transit networks.
vs. FastNetMon
Built for the same use case. Designed for modern teams.
FastNetMon popularized SPAN-based DDoS detection. Flowtriq's mirror mode provides the same per-IP monitoring capability with a modern cloud dashboard, per-IP baseline learning, multi-channel alerting, automated runbooks, and a full REST API.
Typical SPAN Monitor
- Static per-IP thresholds
- CLI-only configuration
- Single notification channel
- No per-IP forensics
- Manual threshold tuning
Flowtriq Mirror Mode
- Dynamic per-IP baselines (p99 x 3)
- Web dashboard + full REST API
- 12+ alert channels + escalation
- Per-IP PCAP + protocol classification
- Automatic baseline learning
FAQ
Common questions
How is mirror mode different from agent mode?
In agent mode, the FTAgent runs on each server and monitors its own traffic via /proc/net/dev. In mirror mode, a single FTAgent instance captures packets from a SPAN/mirror port and detects attacks targeting any destination IP in the monitored segment. Each IP gets its own independent baseline and threshold.
What kind of switch/router configuration do I need?
You need a switch or router that supports port mirroring (SPAN), RSPAN, or a network TAP. Configure it to copy traffic from your uplink or specific VLANs to a dedicated monitoring port, then connect a server running the FTAgent to that port.
Can mirror mode handle high packet rates?
Yes. The capture engine uses AF_PACKET with PACKET_FANOUT for multi-thread distribution on Linux, handling millions of packets per second. For extremely high-volume environments, a tcpdump fallback mode is also available.
What happens when an attack is detected on one IP?
Each destination IP is tracked independently. When one IP exceeds its per-IP threshold, an incident is opened for that specific IP. Other IPs on the same segment continue to be monitored normally. Multiple IPs can be under attack simultaneously with separate incidents.
Can I use mirror mode alongside flow collection?
Yes. Mirror mode can operate with AF_PACKET capture from a SPAN port, sFlow/NetFlow/IPFIX from routers, or both. When both sources are available, the agent merges them per-IP and uses the higher reading for each destination.
How does baseline learning work per-IP?
Each destination IP gets its own BaselineManager instance with a sliding window (default 5 minutes). The agent learns each IP's normal traffic pattern independently, so a web server at 10K PPS and a database at 200 PPS each get appropriate thresholds. New IPs use a 10K PPS absolute floor until their baseline is established.
Related Features
Works with everything else in Flowtriq.
FAQ