Requirements
Routers and switches
Which flow formats and routers Heimnull works with, and what your routers need for blackholes and FlowSpec.
Flow export
Section titled “Flow export”Heimnull collects NetFlow v9, IPFIX and sFlow v5. NetFlow v5 isn’t supported.
| Device | Export | Tested with | Guide |
|---|---|---|---|
| Juniper MX | IPFIX packet sampling (inline monitoring), or inline J-Flow | MX480 captures | Juniper MX |
| Juniper EX | sFlow v5 | EX4300 | Juniper EX (sFlow) |
| Juniper SRX | J-Flow v9, plus NAT session logs | SRX340, Junos 23.4R2 | Juniper SRX |
| MikroTik | NetFlow v9 or IPFIX (traffic-flow) | RouterOS 7 captures; RouterOS 6 with packet sampling off | MikroTik |
Other routers and switches that export standard NetFlow v9, IPFIX or sFlow v5 work too, and any router that accepts BGP routes can act on a blackhole. Using one without a guide? Write to info@heimnull.com with its model and software release. Heimnull learns each exporter’s templates and shows exactly which fields it sends (Configure → Exporters → Templates and fields).
What every exporter needs:
- A stable source address. Heimnull identifies an exporter by the source address of its datagrams. Use a loopback or a fixed interface address.
- Export on the edge, once. Sample on the interfaces facing the internet (transit and peering), so each packet is counted once. The router guides say where.
- A known sampling rate. Most routers send their rate in the records or in an options template, and Heimnull applies it. For one that doesn’t, set the rate on the exporter in Heimnull.
- Short timeouts for routers that export flows from a flow cache (NetFlow v9 or IPFIX flows, not packet samples): an inactive timeout of 10 seconds or less and an active timeout of 30 seconds or less. Detection can’t see traffic before the router exports it.
SNMP (optional)
Section titled “SNMP (optional)”With SNMP v2c or v3, Heimnull reads each exporter’s interface names, descriptions, speeds and counters every minute. You get interface names instead of numbers, utilization against capacity, a check of flow totals against the interface counters, and capacity forecasts.
Mitigation
Section titled “Mitigation”Heimnull mitigates attacks by announcing routes to your routers over BGP. It needs:
- A BGP session (iBGP or eBGP) from each router that should act on them. Heimnull accepts no routes from its peers; configure the router to send it nothing.
- For blackholes (RTBH): the router accepts host routes (/32 and /128) inside your networks that carry your blackhole community, and drops their traffic (a discard next hop). Any router that speaks BGP can do this.
- For FlowSpec: the router supports BGP FlowSpec (RFC 8955 for IPv4, RFC 8956 for IPv6) and installs the rules as filters. Juniper MX does. MikroTik RouterOS doesn’t, so a MikroTik gets blackholes only.
- Optionally, upstream RTBH: your transit providers accept blackhole routes from you with their community, so attack traffic is dropped before it reaches your link.
Mitigation needs the trial or a paid license. In Free mode, attacks are detected and notified, but nothing is announced. See Licensing.