samplicator VS FastNetMon

However, if the SNMP traps happen over UDP (and I think they do, SNMP generally travels over UDP) you can use something like samplicator to receive and re-send the traps while spoofing an IP address. The -S flag tells it which IP address to spoof.

This tool should help with the UDP duplication beyond the two target challenge with iptables: https://github.com/sleinen/samplicator - still, some additional details on the app/data being transmitted would help; data actually push only? Did you verify that targets other than the original host would correctly interpret the data?

You could also flip this idea on its head and point the feed at something which will replicate the packets to both the endpoints, like samplicator, which you could run on one or the other of the servers if you wanted. I use this sometimes to replicate netflow or syslog data. It does create a bit more dependency chaining, but is simple and basically 'free'.

I can't say for sure on the Fortigate, but I use Samplicator for duplicating flows to more collectors than my equipment can export to.

Samplicator is a simple tool for receiving UDP datagrams on a given port and resending them to a specified set of receivers for occasions when you need to export NetFlow traffic to more than one NetFlow collector. Can also be configured to individually specify a sampling divisor N for each receiver that will only receive one in N of the received packets. crankynetadmin adds, "It's normally used for replicating netflow data, but can also replicate any UDP traffic."

As another commented mentioned we use Samplicator. Works for lots of different UDP traffic.

If you have a BGP peering with you ISP/upstream provider, ask them if they have a blackhole community you can broadcast to. Usually they are ASN:666. The only downside is you would only be able to advertise your IP address to that, essentially killing your internet (if that's your only IP) as long as the block is up. We usually set our filter to 15 minutes and most attackers give up after that. At this level, you probably would have your own ASN with a small range and could potentially use something like FastNetMon (https://fastnetmon.com) to automatically advertise and remove IPs from the community.

Have you looked at fastnetmon ? It's freemium and It looks like the commercial version would work you, but I think the community edition is aslo worth a look. It's primary function is to detect DDOS attacks, but it can export data in ways that might be useful to you.

To mitigate DoS attacks means you need information - preferably before the users start screaming. Running sampling on your edge router with something like Fastnetmon will give you alerting of a probable DDoS attack before it becomes a significant problem.

notify_about_attack.sh https://github.com/pavel-odintsov/fastnetmon/blob/master/src/notify_about_attack.sh