Introduction
Kapkan is free, open-source DDoS (Distributed Denial of Service) detection and RTBH mitigation for ISPs and hosting providers.
It is a single Go binary that ingests flow telemetry — NetFlow v5/v9, IPFIX and sFlow v5 —
from your routers, detects volumetric attacks against the prefixes (IP ranges
in CIDR form, e.g. 203.0.113.0/24) you protect in seconds, and triggers automated
BGP (Border Gateway Protocol — how routers exchange routes)
RTBH (remotely-triggered blackhole) mitigation. It ships with a
REST API, a built-in web dashboard, Prometheus metrics, and Telegram / Slack / email /
webhook / exec-hook notifications.
Kapkan is a free replacement for the features commercial flow-DDoS products charge for.
iNew to BGP, RTBH or NetFlow?
That's fine — the Quickstart walks you through it, the Glossary explains every term, and Kapkan won't touch a single route until you say so. Kapkan handles volumetric attacks (floods that try to saturate your link or host with raw packet and bit volume), not application-layer attacks.
!Dry-run by default
Until you explicitly set dry_run: false, every would-be blackhole is logged and exposed
through the API — but never announced to your routers. You can run Kapkan against
production telemetry and validate detection before it can touch a single route. See the
Safety model.
What it does
- Ingest — sFlow v5, NetFlow v5/v9 and IPFIX over UDP, in library mode (no sidecar), via goflow2.
- Detect — per-destination volumetric attacks using sampling-corrected pps / Mbps / flows-per-second thresholds over a sliding window, plus optional per-protocol limits, learned baselines and outgoing-attack detection.
- Classify — each attack is labelled from its flow sample: amplification (NTP / DNS / CLDAP / memcached / SSDP / chargen), SYN / UDP / TCP / ICMP / fragment floods.
- Mitigate — announce
/32and/128blackhole routes via an embedded GoBGP speaker, drop only the attack vector with surgical BGP FlowSpec rules (RFC 8955/8956), or divert the victim to a scrubbing centre instead of dropping its traffic — optionally stepped up over time with escalation ladders. Kapkan tracks each mitigation decision as a ban; for the default method a ban is a blackhole route (RTBH). - Observe — a REST API, an embedded web dashboard, Prometheus
/metrics, and notifications over Telegram, Slack, email, webhook and an exec hook. - Persist (optional) — keep attack and traffic history in ClickHouse for forensics and reporting.
Who it is for
Network operators — ISPs, hosting providers and anyone running BGP — who need automated volumetric-attack mitigation without a commercial license (including FastNetMon Community users looking for an open-source alternative).
Why Kapkan
| Kapkan | |
|---|---|
| License | Apache 2.0, fully open source — including the detection logic |
| Footprint | One static Go binary; no MongoDB, no separate web service |
| Web UI | Embedded dashboard included, not a paid add-on |
| Configuration | Declarative YAML you can keep in git and diff |
| Safety | Dry-run by default; TTLs, hysteresis and ban caps enforced in code |
What it does not do (yet)
These are on the roadmap but not in the current release:
- Built-in high-availability deduplication across instances
- Port-mirror (SPAN / AF_PACKET / XDP) capture as an ingest source
- Per-tenant notification routing (today, notifications are global; tenant scoping applies to the API only)
Next steps
New here? Start with the Quickstart — download Kapkan, point a router at it, and see your first detection. (No router yet? You can still drive synthetic attack traffic from source — the Quickstart shows how.)
Then:
- How it works — the ingest → engine → mitigate pipeline.
- Configuration reference — every key in the YAML file.
- Going live — how to safely turn off dry-run.