Blocked DDoS Metrics

crowdsec
1

Thanks to CrowdSec, we were able to block an apparent DDoS against a school district’s sites. After reviewing logs, etc I was wondering if there’s a way with CrowdSec or another way to see how much traffic has been blocked. With the WAF we use, we can see all blocked traffic, but with CrowdSec firewalling the traffic, we don’t have a good metric of its impact.

1 Like
2

Only way I see is to have your bouncer verbose about blocked traffic (deny-log here).
Then render the logs, using something like Iptables Montoring Dashboard dashboard for Grafana | Grafana Labs.

3

late to the party but for future reference:

imho easier is to only use crowdsec-bounce to only manage the firewall set and use custom rules with a “counter” at the drop rule.

bouncer yaml file:

[...]
## nftables
nftables:
  ipv4:
    enabled: true
    set-only: true
    table: crowdsec
    chain: crowdsec-chain
  ipv6:
    enabled: true
    set-only: true
    table: crowdsec6
    chain: crowdsec6-chain

and in the nftables example from Firewall Bouncer | CrowdSec

- ip6 saddr @crowdsec6-blacklists drop
+ ip6 saddr @crowdsec6-blacklists counter drop

(has of cource also be done for the ipv4 drop rule).

Then you can see the counters with “sudo nft list ruleset” and scrape the metrics with e.g. GitHub - metal-stack/nftables-exporter: prometheus exporter for nftables metrics

Imho this is easier than log counting.