FastNetMon VS ntopng

If you have a BGP peering with you ISP/upstream provider, ask them if they have a blackhole community you can broadcast to. Usually they are ASN:666. The only downside is you would only be able to advertise your IP address to that, essentially killing your internet (if that's your only IP) as long as the block is up. We usually set our filter to 15 minutes and most attackers give up after that. At this level, you probably would have your own ASN with a small range and could potentially use something like FastNetMon (https://fastnetmon.com) to automatically advertise and remove IPs from the community.

Have you looked at fastnetmon ? It's freemium and It looks like the commercial version would work you, but I think the community edition is aslo worth a look. It's primary function is to detect DDOS attacks, but it can export data in ways that might be useful to you.

To mitigate DoS attacks means you need information - preferably before the users start screaming. Running sampling on your edge router with something like Fastnetmon will give you alerting of a probable DDoS attack before it becomes a significant problem.

notify_about_attack.sh https://github.com/pavel-odintsov/fastnetmon/blob/master/src/notify_about_attack.sh

and use software: https://www.ntop.org/

InfluxDB 2.0 Support (ntopng github)

For what it's worth, there used to be a package in many Linux repositories called "ntop" [1] but became less popular when they went commercial. There is still a community version but I have no idea how popular it is any more. It was quite popular prior to projects like PiHole. Perhaps the older ntop has fallen out of favor so maybe there won't be any confusion.

[1] - https://www.ntop.org/

Have you seen https://github.com/ntop/ntopng?

NTOP -- Traffic Analysis.

One of the comments suggests using a managed switch that supports port mirroring, and installing a Flow collector on the connected system. Google netflow collector for software options. Something like ntop may work. See... HowTo Monitor Traffic in SMEs and Home Networks: A Primer

What can I do to implement GeoIP support into ntopng? The instructions I found on the internet (e.g. https://github.com/ntop/ntopng/blob/dev/doc/README.geolocation.md) did not seem to fit the case.