Skip to content

Commit 9f93309

Browse files
skrthomasskrthomas
authored
Merge pull request #80610 from skrthomas/OSDOCS-11615
OSDOCS-11615: TCP flags filtering + SYN flooding alerts and metrics
2 parents c8f4033 + 4083e2a commit 9f93309

File tree

4 files changed

+92
-1
lines changed

4 files changed

+92
-1
lines changed

‎modules/network-observability-flow-filter-parameters.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ The flow filter rules consist of required and optional parameters.
3838
|`protocol`
3939
| Defines the protocol of the flow filter rule. Possible values are `TCP`, `UDP`, `SCTP`, `ICMP`, and `ICMPv6`.
4040

41+
|`tcpFlags`
42+
| Defines the TCP flags to filter flows. Possible values are `SYN`, `SYN-ACK`, `ACK`, `FIN`, `RST`, `PSH`, `URG`, `ECE`, `CWR`, `FIN-ACK`, and `RST-ACK`.
43+
4144
| `ports`
4245
| Defines the ports to use for filtering flows. It can be used for either source or destination ports. To filter a single port, set a single port as an integer value. For example `ports: 80`. To filter a range of ports, use a "start-end" range in string format. For example `ports: "80-100"`
4346

‎modules/network-observability-tcp-flag-syn-flood.adoc

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
// Module included in the following assemblies:
2+
//
3+
// network_observability/metrics-alerts-dashboards.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="network-observability-tcp-flag-syn-flood_{context}"]
7+
= Detecting SYN flooding using the FlowMetric API and TCP flags
8+
You can create an `AlertingRule` resouce to alert for SYN flooding.
9+
10+
.Procedure
11+
. In the web console, navigate to *Operators* -> *Installed Operators*.
12+
. In the *Provided APIs* heading for the *NetObserv Operator*, select *FlowMetric*.
13+
. In the *Project* dropdown list, select the project of the Network Observability Operator instance.
14+
. Click *Create FlowMetric*.
15+
. Create `FlowMetric` resources to add the following configurations:
16+
+
17+
.Configuration counting flows per destination host and resource, with TCP flags
18+
[source,yaml]
19+
----
20+
apiVersion: flows.netobserv.io/v1alpha1
21+
kind: FlowMetric
22+
metadata:
23+
name: flows-with-flags-per-destination
24+
spec:
25+
metricName: flows_with_flags_per_destination_total
26+
type: Counter
27+
labels: [SrcSubnetLabel,DstSubnetLabel,DstK8S_Name,DstK8S_Type,DstK8S_HostName,DstK8S_Namespace,Flags]
28+
----
29+
+
30+
.Configuration counting flows per source host and resource, with TCP flags
31+
[source,yaml]
32+
----
33+
apiVersion: flows.netobserv.io/v1alpha1
34+
kind: FlowMetric
35+
metadata:
36+
name: flows-with-flags-per-source
37+
spec:
38+
metricName: flows_with_flags_per_source_total
39+
type: Counter
40+
labels: [DstSubnetLabel,SrcSubnetLabel,SrcK8S_Name,SrcK8S_Type,SrcK8S_HostName,SrcK8S_Namespace,Flags]
41+
----
42+
. Deploy the following `AlertingRule` resource to alert for SYN flooding:
43+
+
44+
.`AlertingRule` for SYN flooding
45+
[source,yaml]
46+
----
47+
apiVersion: monitoring.openshift.io/v1
48+
kind: AlertingRule
49+
metadata:
50+
name: netobserv-syn-alerts
51+
namespace: openshift-monitoring
52+
# ...
53+
spec:
54+
groups:
55+
- name: NetObservSYNAlerts
56+
rules:
57+
- alert: NetObserv-SYNFlood-in
58+
annotations:
59+
message: |-
60+
{{ $labels.job }}: incoming SYN-flood attack suspected to Host={{ $labels.DstK8S_HostName}}, Namespace={{ $labels.DstK8S_Namespace }}, Resource={{ $labels.DstK8S_Name }}. This is characterized by a high volume of SYN-only flows with different source IPs and/or ports.
61+
summary: "Incoming SYN-flood"
62+
expr: sum(rate(netobserv_flows_with_flags_per_destination_total{Flags="2"}[1m])) by (job, DstK8S_HostName, DstK8S_Namespace, DstK8S_Name) > 300 <1>
63+
for: 15s
64+
labels:
65+
severity: warning
66+
app: netobserv
67+
- alert: NetObserv-SYNFlood-out
68+
annotations:
69+
message: |-
70+
{{ $labels.job }}: outgoing SYN-flood attack suspected from Host={{ $labels.SrcK8S_HostName}}, Namespace={{ $labels.SrcK8S_Namespace }}, Resource={{ $labels.SrcK8S_Name }}. This is characterized by a high volume of SYN-only flows with different source IPs and/or ports.
71+
summary: "Outgoing SYN-flood"
72+
expr: sum(rate(netobserv_flows_with_flags_per_source_total{Flags="2"}[1m])) by (job, SrcK8S_HostName, SrcK8S_Namespace, SrcK8S_Name) > 300 <1>
73+
for: 15s
74+
labels:
75+
severity: warning
76+
app: netobserv
77+
# ...
78+
----
79+
<1> In this example, the threshold for the alert is `300`; however, you can adapt this value empirically. A threshold that is too low might produce false-positives, and if it's too high it might miss actual attacks.
80+
81+
.Verification
82+
. In the web console, click *Manage Columns* in the *Network Traffic* table view and click *TCP flags*.
83+
. In the *Network Traffic* table view, filter on *TCP protocol SYN TCPFlag*. A large number of flows with the same *byteSize* indicates a SYN flood.
84+
. Go to *Observe* -> *Alerting* and select the *Alerting Rules* tab.
85+
. Filter on *netobserv-synflood-in alert*. The alert should fire when SYN flooding occurs.

‎observability/network_observability/metrics-alerts-dashboards.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,10 @@ include::modules/network-observability-configuring-custom-metrics.adoc[leveloffs
2020
High cardinality can affect the memory usage of Prometheus. You can check whether specific labels have high cardinality in the xref:../../observability/network_observability/json-flows-format-reference.adocl#network-observability-flows-format_json_reference[Network Flows format reference].
2121
====
2222
include::modules/network-observability-flowmetrics-charts.adoc[leveloffset=+1]
23+
include::modules/network-observability-tcp-flag-syn-flood.adoc[leveloffset=+1]
2324

2425
[role="_additional-resources"]
2526
.Additional resources
27+
* xref:../../observability/network_observability/observing-network-traffic.adoc#network-observability-filtering-ebpf-rule_nw-observe-network-traffic[Filtering eBPF flow data using a global rule]
2628
* xref:../../observability/monitoring/managing-alerts.adoc#creating-alerting-rules-for-user-defined-projects_managing-alerts[Creating alerting rules for user-defined projects].
2729
* xref:../../support/troubleshooting/investigating-monitoring-issues.adoc#determining-why-prometheus-is-consuming-disk-space_investigating-monitoring-issues[Troubleshooting high cardinality metrics- Determining why Prometheus is consuming a lot of disk space]

‎observability/network_observability/observing-network-traffic.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,4 +65,5 @@ Alternatively, you can access the traffic flow data in the *Network Traffic* tab
6565

6666
[role="_additional-resources"]
6767
.Additional resources
68-
For more information about configuring quick filters in the `FlowCollector`, see xref:../../observability/network_observability/configuring-operator.adoc#network-observability-config-quick-filters_network_observability[Configuring Quick Filters] and the xref:../../observability/network_observability/configuring-operator.adoc#network-observability-flowcollector-view_network_observability[Flow Collector sample resource].
68+
* xref:../../observability/network_observability/configuring-operator.adoc#network-observability-config-quick-filters_network_observability[Configuring Quick Filters]
69+
* xref:../../observability/network_observability/configuring-operator.adoc#network-observability-flowcollector-view_network_observability[Flow Collector sample resource]

0 commit comments

Comments
 (0)