GitHub

Introduction

Kapkan is free, open-source DDoS (Distributed Denial of Service) detection and RTBH mitigation for ISPs and hosting providers.

It is a single Go binary that ingests flow telemetry — NetFlow v5/v9, IPFIX and sFlow v5 — from your routers, detects volumetric attacks against the prefixes (IP ranges in CIDR form, e.g. 203.0.113.0/24) you protect in seconds, and triggers automated BGP (Border Gateway Protocol — how routers exchange routes) RTBH (remotely-triggered blackhole) mitigation. It ships with a REST API, a built-in web dashboard, Prometheus metrics, and Telegram / Slack / email / webhook / exec-hook notifications.

Kapkan is a free replacement for the features commercial flow-DDoS products charge for.

iNew to BGP, RTBH or NetFlow?

That's fine — the Quickstart walks you through it, the Glossary explains every term, and Kapkan won't touch a single route until you say so. Kapkan handles volumetric attacks (floods that try to saturate your link or host with raw packet and bit volume), not application-layer attacks.

!Dry-run by default

Until you explicitly set dry_run: false, every would-be blackhole is logged and exposed through the API — but never announced to your routers. You can run Kapkan against production telemetry and validate detection before it can touch a single route. See the Safety model.

What it does

  • Ingest — sFlow v5, NetFlow v5/v9 and IPFIX over UDP, in library mode (no sidecar), via goflow2.
  • Detect — per-destination volumetric attacks using sampling-corrected pps / Mbps / flows-per-second thresholds over a sliding window, plus optional per-protocol limits, learned baselines and outgoing-attack detection.
  • Classify — each attack is labelled from its flow sample: amplification (NTP / DNS / CLDAP / memcached / SSDP / chargen), SYN / UDP / TCP / ICMP / fragment floods.
  • Mitigate — announce /32 and /128 blackhole routes via an embedded GoBGP speaker, drop only the attack vector with surgical BGP FlowSpec rules (RFC 8955/8956), or divert the victim to a scrubbing centre instead of dropping its traffic — optionally stepped up over time with escalation ladders. Kapkan tracks each mitigation decision as a ban; for the default method a ban is a blackhole route (RTBH).
  • Observe — a REST API, an embedded web dashboard, Prometheus /metrics, and notifications over Telegram, Slack, email, webhook and an exec hook.
  • Persist (optional) — keep attack and traffic history in ClickHouse for forensics and reporting.

Who it is for

Network operators — ISPs, hosting providers and anyone running BGP — who need automated volumetric-attack mitigation without a commercial license (including FastNetMon Community users looking for an open-source alternative).

Why Kapkan

Kapkan
LicenseApache 2.0, fully open source — including the detection logic
FootprintOne static Go binary; no MongoDB, no separate web service
Web UIEmbedded dashboard included, not a paid add-on
ConfigurationDeclarative YAML you can keep in git and diff
SafetyDry-run by default; TTLs, hysteresis and ban caps enforced in code

What it does not do (yet)

These are on the roadmap but not in the current release:

  • Built-in high-availability deduplication across instances
  • Port-mirror (SPAN / AF_PACKET / XDP) capture as an ingest source
  • Per-tenant notification routing (today, notifications are global; tenant scoping applies to the API only)

Next steps

New here? Start with the Quickstart — download Kapkan, point a router at it, and see your first detection. (No router yet? You can still drive synthetic attack traffic from source — the Quickstart shows how.)

Then: