In current design of FastNetMon by default it counts traffic which originates from your networks and going towards your networks as "internal" and completely disables DDoS detection actions and does not include this traffic to per host traffic metrics.

This logic may be changed by using following flags override_internal_traffic_as_incoming and override_internal_traffic_as_outgoing but we have no logic to count it for both incoming and outgoing.

Such logic will be very beneficial in cases of complex networks and when there is a risk of spoofing which pretends to be coming from same prefixes as prefixes which belong to customer.