Add Flowtriq Agent egg - #5
Conversation
Network traffic monitoring and DDoS detection agent that reports to the Flowtriq dashboard. Installs via pip, runs as a Python module, and monitors traffic volume using /proc/net/dev.
|
Shouldn't the container only see its own |
Addresses review feedback: containerized ftagent can only see its own
/proc/net/dev, not the host's network stats. Switched to flow collector
mode where the agent receives sFlow/NetFlow/IPFIX from network equipment
instead of monitoring local traffic.
Changes:
- Config written at startup using {{SERVER_PORT}} for the flow port
- flow_enabled=true, pcap_enabled=false in config
- Added flow protocol variable (auto/sflow/netflow_v5/netflow_v9/ipfix)
- Removed FTAGENT_FLOW_PORT variable (uses Pelican port allocation)
- Updated description and README for flow collector use case
|
Good catch. You're right, the container would only see its own traffic through /proc/net/dev, and pcap would need CAP_NET_RAW. I've updated the egg to run in flow collector mode instead. The agent listens on the server's allocated port for incoming sFlow, NetFlow v5/v9, or IPFIX data from the host's router or switch. No local traffic monitoring, no packet capture. Changes in the latest push:
The host configures their network equipment to export flows to this container's IP and port. The agent parses flows, builds baselines, and detects attacks. |
| "file_denylist": [], | ||
| "startup": "PYTHONPATH=/home/container /usr/local/bin/python -m ftagent --config /home/container/config.json", | ||
| "startup": "echo '{\"api_key\":\"{{FTAGENT_API_KEY}}\",\"node_uuid\":\"{{FTAGENT_NODE_UUID}}\",\"api_base\":\"{{FTAGENT_API_BASE}}\",\"pcap_enabled\":false,\"flow_enabled\":true,\"flow_protocol\":\"{{FTAGENT_FLOW_PROTOCOL}}\",\"flow_port\":{{SERVER_PORT}},\"flow_bind\":\"0.0.0.0\"}' > /home/container/config.json && PYTHONPATH=/home/container /usr/local/bin/python -m ftagent --config /home/container/config.json", | ||
| "config": { |
There was a problem hiding this comment.
The config can be managed by the panel as it starts and doesn't need to be in the startup.
There was a problem hiding this comment.
pythonpath is not needed, becasue python is not installed in /home/container
Install script now creates a base config.json, and the panel manages variable injection via the JSON parser on each start.
|
Good call. I moved config generation into |
| "file_denylist": [], | ||
| "startup": "PYTHONPATH=/home/container /usr/local/bin/python -m ftagent --config /home/container/config.json", | ||
| "startup": "echo '{\"api_key\":\"{{FTAGENT_API_KEY}}\",\"node_uuid\":\"{{FTAGENT_NODE_UUID}}\",\"api_base\":\"{{FTAGENT_API_BASE}}\",\"pcap_enabled\":false,\"flow_enabled\":true,\"flow_protocol\":\"{{FTAGENT_FLOW_PROTOCOL}}\",\"flow_port\":{{SERVER_PORT}},\"flow_bind\":\"0.0.0.0\"}' > /home/container/config.json && PYTHONPATH=/home/container /usr/local/bin/python -m ftagent --config /home/container/config.json", | ||
| "config": { |
There was a problem hiding this comment.
pythonpath is not needed, becasue python is not installed in /home/container
python -m adds cwd to sys.path, so cd /home/container is enough for Python to find the ftagent package.
|
Fixed. Dropped PYTHONPATH and the absolute python path. Startup now does |
3 participants
Description
Adds a Pelican egg for the Flowtriq Agent (ftagent), a network traffic monitoring and DDoS detection agent. It monitors traffic volume, detects volumetric attacks, and reports to the Flowtriq dashboard for alerting and incident management.
The egg installs ftagent from PyPI, writes a config file from the panel variables, and runs the agent as a Python module. PCAP capture is disabled since the container runs without root privileges. The agent monitors traffic using
/proc/net/devcounters instead.Checklist for all submissions
Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?
Have you tested and reviewed your changes with confidence that everything works?
Did you branch your changes and PR from that branch and not from your master branch?
You verify that the start command applied does not use a shell script
The egg was exported from the panel
New egg Submissions
Note: The egg JSON was written manually rather than exported from the panel, since we do not have a Pelican panel instance to export from. The JSON follows the PLCN_v2 format and matches the structure of existing eggs (Prometheus, Loki) in this repo.