Evaluating DDoS detection
at RIPE 92 in Edinburgh?
RIPE 92 brings together Europe's ISPs, IXPs, and network operators. Before you commit to FastNetMon — their Advanced license is $115/month and LiveView adds $70/user/month on top. Flowtriq gives you sub-second kernel-level detection, BGP FlowSpec, and PCAP forensics at $9.99/node with unlimited team access included.
Who Flowtriq is built for
The same operators who attend RIPE meetings are running Flowtriq in production today.
The pricing reality
What FastNetMon actually costs at RIPE scale
FastNetMon launched LiveView in April 2026 — a web dashboard add-on at $70/user/month on top of the existing Advanced license. Here's what that means for a 3-person NOC.
Advanced license (10G tier): $115/month. LiveView dashboard: $70/user/month × 3 users. Dedicated server hardware: ~$100/month (not included in FastNetMon's pricing).
FastNetMon
- $115/mo base + $70/user/mo dashboard add-on
- Dedicated server required (~$60–150/mo extra)
- 30–60s detection via NetFlow sampling
- No PCAP forensics
- No L7 / HTTP flood detection
- No cloud API mitigations
- Trial by application — gated
Flowtriq — $9.99/node/month
- $9.99/node/month — unlimited users, dashboard included
- No dedicated server — agent on existing Linux hosts
- <1s detection — kernel-level, unsampled
- PCAP with pre-attack ring buffer
- L7 HTTP flood detection (access log parsing)
- Cloud API mitigations (Cloudflare, DO, Vultr, Linode)
- 7-day free trial — no card, no application
Feature comparison
FastNetMon Advanced vs Flowtriq
Every capability that matters to a RIPE attendee — network engineers who live and breathe BGP.
| Capability | FastNetMon Advanced + LiveView | Flowtriq |
|---|---|---|
| Detection | ||
| Detection method | NetFlow / sFlow / IPFIX (sampled) | Kernel-level per-packet, unsampled |
| Detection latency | 30–60s (NetFlow export interval) | <1 second |
| Attack classification | Flood type only | 7 families + confidence score |
| L7 HTTP flood detection | L3/L4 only | Access log parsing |
| BGP & Mitigation | ||
| BGP RTBH blackhole | Yes | Yes |
| BGP FlowSpec | Advanced only ($115+/mo) | Included at $9.99/node |
| Automated FlowSpec | Manual — false positives block automation | Confidence-gated + auto-rollback |
| BGP speaker support | ExaBGP, GoBGP | ExaBGP, GoBGP, BIRD 2, FRRouting |
| Detection → BGP <2s | No | Yes |
| Forensics & Evidence | ||
| PCAP capture | Not available | Pre-attack ring buffer + analyzer |
| AI incident summaries | No | Yes |
| Hash-chained audit log | No | SHA-256 |
| Operations | ||
| Web dashboard | LiveView add-on +$70/user/mo | Included, unlimited users |
| REST API | Advanced only | Included |
| Prometheus + Terraform | No Terraform; Prometheus Advanced only | Both included |
| Dedicated server required | Yes (~$60–150/mo) | No — agent on existing hosts |
| Setup time | Hours | 60 seconds: pip install ftagent |
For network engineers
How Flowtriq actually works
The technical architecture — no marketing speak.
Kernel-level capture
Uses AF_PACKET with BPF filtering — every packet header, unsampled, at line rate. No NetFlow dependency. No router changes.
EWMA dynamic baselines
Exponentially Weighted Moving Average per node. Auto-learns in ~5 minutes. No manual threshold tuning. Handles diurnal patterns automatically.
BGP FlowSpec automation
Rules generated from attack classification + confidence score. Auto-rollback when confidence drops. Works with ExaBGP, GoBGP, BIRD 2, FRRouting.
PCAP ring buffer
Rolling pre-attack buffer. When an incident fires, the buffer is flushed and attached — packet-level evidence from before the attack peaked.
Resource footprint
<30 MB RAM, <0.1% CPU at idle. systemd service. Any Linux kernel ≥ 3.10. No kernel module, no DPDK, no PF_RING.
Multi-tenancy
Workspace-based RBAC (Owner, Admin, Analyst, Readonly). ISPs and MSPs manage customer nodes with isolated alerting and reporting.
Try it before RIPE 92 — no gatekeeping
7 days full access. No credit card. No application form. No bandwidth questionnaire. Deploy in 60 seconds on any Linux server you already have.