Feature requests

We have such capability only for /32 or /128 but not not for total hostgroups.

Customer raised request to have an option to specify range of ports for flexible threshold rule like this: 8000..10000

In response to rise of carpet bombing attacks we need to provide flow spec based mitigations on whole prefix.

Current version of FastNetMon uses single CPU core to calculate traffic speed. Even on fastest CPUs we can handle around ~1m+ active hosts with traffic. We need to be able to process even more active hosts by scaling speed processing by multiple CPU cores. Our current plan to shard all speed counters into multiple segments and process them independently.

Add limit about number of flow spec announces because upstream breaks bgp session

Implement email attack alert recepients on hostgroup basis

To make remote attacks mitigation more efficient we can provide option to add attacker IPs to firwall list this way: https://forum.mikrotik.com/viewtopic.php?t=184113

For example it may be useful to create flexible threshold only for specific type of traffic like: traffic from port 11211 udp and then in same time to have catch-all threshold which will include everything else to ensure protection from other attack types. We definitely can create static threshold for UDP traffic but it will catch traffic which is already included in flexible thresholds and both of them will trigger in same time which is not desirable outcome It cannot be implementer right now but by adding flexible threshold like this: 1) port 11211 udp 2) port 123 UDP 3) not port 123 and not port 11211 UDP Section 3 cannot be implemented right now but it's important for us to have in our tool

When adding a flowspec rule using the API the API does not return the newly created flowspec rule ID. This ID should be returned so that scripts can save it for later use (like to deleting the flowspec rule)

IPv6 support for BGP Flow spec mode