RE: FastNetMon Usage in the wild

[Adam Thompson <athompson () merlin mb ca>]

We use Arbor’s Sightline in an SFlow + Flowspec topology.  It… works.  It needs a lot of tuning.  It’s moderately 
expensive to deploy in this topology, unlike in-band which is holy-cow-expensive at our speeds.  If you want 
historical/forensic data, you need to buy a moderately-expensive hardware server (they don’t let you virtualize it) for 
their Insight module.  Arbor’s tech support is Quite Good Indeed, and their SE team is FANTASTIC.  Sales, however, not 
so much.  We don’t feel Sightline is doing all that much for us, but we also aren’t able to put the required amount of 
daily care and feeding into it that it needs, so YMMV.

My overall impression is that all the on-prem anti-DDOS products out there do the same thing, and work much the same 
way – thresholds, hopefully with auto-baselining.  The differentiating factors IMHO are whether the auto-baselining can 
take time-of-day, day-of-week, and month into account (e.g. business day, K-12 school year, etc.); we believe 
Sightline’s auto-baselining doesn’t do a great job here.  Beyond that, any product that uses an evolving statistical 
model (probably branded as “AI”, sigh) will have a slightly better chance of improving the successful hit ratio.

I’m not aware of any anti-DDoS products at ISP scale that aren’t SFlow + Flowspec, possibly including “scrubbing” 
(diverter box); having said that, I do know one of my upstreams has a large Sightline h/w appliance of some sort, I 
don’t know if it’s an in-band appliance, or a “scrubber”-on-a-stick, but it’s too expensive for them to upgrade and 
they’re apparently dropping it instead… once we stop telling them quite so loudly to NOT get rid of it , I guess??

AFAIK, FastNetMon is basically the same thing as Sightline, with a less-polished UI. (read: doesn’t make mgmt. as happy 
to look at it) and you need some external support bits to do the Flowspec.

-Adam

Adam Thompson
Consultant, Infrastructure Services
[cid:image001.png@01D9FB80.2D14BDE0]
100 - 135 Innovation Drive
Winnipeg, MB R3T 6A8
(204) 977-6824 or 1-800-430-6404 (MB only)
https://www.merlin.mb.ca<https://www.merlin.mb.ca/>
[cid:image002.png@01D9FB80.2D14BDE0]Chat with me on Teams<https://teams.microsoft.com/l/chat/0/0?users=athompson () 
merlin mb ca>


From: NANOG <nanog-bounces+athompson=merlin.mb.ca () nanog org> On Behalf Of Javier Gutierrez
Sent: Friday, October 6, 2023 5:20 PM
To: nanog () nanog org
Subject: FastNetMon Usage in the wild

Hi,
I wanted to drop a quick question as I would like to evaluate the FastNetMon solution to do DDoS protection and wanted 
to see what other companies are using it out there so I can have a base of how much should I recommend this.

Thanks in advance for your responses


Kind regards,


Javier Gutierrez,