F
FastNetMon
Starting from v2.0.381 we added support for manual announcement / withdrawal of IPv6 flow spec announcements with full validations:
sudo fcli set flowspec '{ "source_prefix": "2a13:ff40::1/128", "destination_prefix": "dead::beef/128", "destination_ports": [ 80 ], "source_ports": [ 53, 5353 ], "packet_lengths": [ 777, 1122 ], "protocols": [ "tcp" ], "fragmentation_flags": [ "is-fragment", "dont-fragment" ], "tcp_flags": [ "syn" ], "action_type": "rate-limit", "action": { "rate": 1024 } }'
And then:
gobgp global rib -a ipv6-flow
Network Next Hop AS_PATH Age Attrs
*> [destination: dead::beef/128/0][source: 2a13:ff40::1/128/0][protocol: ==tcp][destination-port: ==80][source-port: ==53 ==5353][tcp-flags: S][packet-length: ==777 ==1122][fragment: is-fragment dont-fragment] fictitious 00:00:28 [{Origin: ?} {Extcomms: [rate: 1024.000000]}]
Sanwar Reaz
I think FastnetMon team should deploy IPv6 Flowspec feature.
F
FastNetMon
We made small progress and added logic to parse IPv6 addresses for Flow Spec announces injected via CLI in mode with validation disabled:
sudo fcli set main networks_list 2a03:2880:f162:81:face:b00c:0:25de/64
sudo fcli set main flow_spec_execute_validation disable
sudo fcli commit
sudo fcli set flowspec '{ "source_prefix": "2a03:2880:f162:81:face:b00c:0:25dd/128", "destination_prefix": "2a03:2880:f162:81:face:b00c:0:25de/128", "destination_ports": [ 80 ], "source_ports": [ 53, 5353 ], "packet_lengths": [ 777, 1122 ], "protocols": [ "tcp" ], "fragmentation_flags": [ "is-fragment", "dont-fragment" ], "tcp_flags": [ "syn" ], "action_type": "rate-limit", "action": { "rate": 1024 } }'
It will not be applied for filtering or mitigation yet but we do parse it correctly.