Looks like it happens with FastNetMon restarted during attack. We have in DB record about attack start, but doesn't have record about attack end, so it shown as active via UI.