Config builder

Assemble a Kapkan configuration on one page — the YAML updates live as you type. Sensible, watch-only-safe defaults are filled in; adjust them to your network.

Runs entirely in your browser. Nothing you enter is sent anywhere.

Watch-onlydry_run: trueMitigation is simulated, nothing is announced — safe to experiment.

Telemetry

sFlow listen address

listen.sflow

NetFlow / IPFIX listen address

listen.netflow

Default sampling rate

sampling.default_rate

Advanced— boundary counting, trusted exporters

Boundary debug counters

sampling.boundary_debug

Interface boundary

sampling.boundary

Trusted exporters

flow_sources

Nothing yet — using the engine default

Networks & groups

Protected prefixes

networks

Never-ban addresses

protected_whitelist

Nothing yet — using the engine default

Host groups

hostgroups

Advanced— tenant label

Global tenant label

tenant

Detection

Per-host thresholds

thresholds

ppsmbpsAny trafficFlows per second

Per-protocol limits

ppsmbps

TCP

TCP SYN

UDP

ICMP

Fragments

Empty = disabled. Any crossed limit triggers (OR).

Advanced— outgoing, baseline, carpet, samples

Outgoing thresholds

thresholds_outgoing

ppsmbpsAny trafficFlows per second

Per-protocol limits

ppsmbps

TCP

TCP SYN

UDP

ICMP

Fragments

Empty = disabled. Any crossed limit triggers (OR).

Baseline (learned thresholds)

Learn baselines

baseline.enabled

Carpet detection

Detect subnet-spread attacks

carpet

Attack samples

Buffer attack samples

samples

Mitigation

Mitigation method

Default method

mitigation

BGP

Local ASN

bgp.local_asn

Router ID

bgp.router_id

Blackhole next-hop (IPv4)

bgp.next_hop

Blackhole next-hop (IPv6)

bgp.next_hop6

RTBH community

bgp.community

Neighbors

bgp.neighbors

bgp.neighbors[0]10.0.0.254

addressremote_asnport

Advanced— Graceful Restart, escalation, BGP extras

Community set

bgp.communities

BGP listen port

bgp.listen_port

LOCAL_PREF

bgp.local_pref

Graceful Restart

bgp.graceful_restart.enabled

Restart hold time

bgp.graceful_restart.restart_seconds

Long-Lived GR (RFC 9494)

bgp.graceful_restart.long_lived

LLGR stale time

bgp.graceful_restart.long_lived_stale_seconds

Escalation ladder

Escalation rungs

escalation

Bans

Ban lifetime

ban.ttl_seconds

≈ 10 min

Unban hysteresis

ban.unban_hysteresis_seconds

≈ 2 min

Max simultaneous bans

ban.max_active_bans

Advanced— fallback, storm guards, persistence

Rejected-announce fallback

ban.fallback

Max banned fraction

ban.max_banned_fraction

Max new bans per window

ban.max_bans_per_window

Storm window

ban.ban_window_seconds

Ban state file

ban.state_file

Notifications

Bot token env var

notify.telegram.token_env

Chat ID

notify.telegram.chat_id

Webhook URL

notify.webhook.url

Slack webhook URL

notify.slack.webhook_url

Advanced— email, exec hook, update check

Email

SMTP host

notify.email.smtp_host

From address

notify.email.from

Recipients

notify.email.to

SMTP user env var

notify.email.username_env

SMTP password env var

notify.email.password_env

Require TLS

notify.email.require_tls

Exec hook

Command path

notify.exec.command

Argument format

notify.exec.format

Timeout

notify.exec.timeout_seconds

Updates

Check for updates

update_check.enabled

API & misc

API listen address

api.listen

Embedded dashboard

api.dashboard

API token env var

api.token_env

Role-based tokens

api.tokens

Advanced— tokens, ClickHouse, GeoIP

ClickHouse history

ClickHouse URL

storage.clickhouse.url

GeoIP

Enable GeoIP/ASN attribution

geoip.enabled

config.yaml

Engine check running…

# Kapkan config — generated by the kapkan.io builder.# Check first:  kapkan -check-config config.yaml dry_run: true  # simulated, never announced listen:  sflow: ":6343"  netflow: ":2055"  # NetFlow v5/v9 + IPFIX sampling:  default_rate: 1000  # when the exporter omits it networks:  # detection scope  - "203.0.113.0/24" thresholds:  # per host, unsampled units  pps: 80000  mbps: 1000  flows_per_sec: 35000 ban:  ttl_seconds: 600  # auto-withdraw after this  unban_hysteresis_seconds: 120  # anti-flap before unban  max_active_bans: 50 bgp:  local_asn: 65001  router_id: "10.0.0.1"  # IPv4 dotted-quad  next_hop: "192.0.2.1"  # blackhole next-hop  community: "65000:666"  # RTBH community  neighbors:    - address: "10.0.0.254"      remote_asn: 65000 api:  listen: "127.0.0.1:8080"  # localhost needs no auth# token_env: "KAPKAN_API_TOKEN"  # required off localhost

Apply on the host

1. Save the file
sudo install -m 0644 config.yaml /etc/kapkan/config.yaml
2. Validate with the engine binary
kapkan -check-config /etc/kapkan/config.yaml
3. Reload the service
sudo systemctl reload kapkan
4. Watch-only: let it observe for about a week (logs + /api/v1/attacks), then set dry_run: false
journalctl -u kapkan -f