Flowtriq

ftagent

Real-time DDoS detection, attack classification, PCAP forensics, and auto-mitigation for Linux servers.
Detects attacks in under 1 second. Classifies 7 families and 16+ subtypes. Mitigates automatically.

PyPI Website Discord Docs

ftagent demo

What it does

ftagent is the on-node agent for Flowtriq, a DDoS detection and mitigation platform built for hosting providers, game server networks, ISPs, and anyone running infrastructure that needs to stay online.

The agent monitors traffic at the packet level, learns your normal traffic patterns, detects attacks the moment they start, classifies them by protocol and vector, captures forensic PCAPs, and triggers automated mitigation through firewall rules, BGP FlowSpec, RTBH, or cloud scrubbing.

In production

  • 159 Gbps multi-vector attack mitigated in 9 seconds for an EU network operator. 40+ customer prefixes on the affected uplink, zero SLA breaches. Detection at 0.7s, FlowSpec active at 9s. (Case study)

  • 48 Gbps NTP amplification + SYN flood during a live 240-person cybersecurity training event. Full mitigation stack active in under 15 seconds. Not one participant noticed. (Case study)

"159 gig hit our transit edge at ten in the morning. Forty-plus customers on that uplink, including a government account with a hard SLA. The whole thing was mitigated before our legacy SNMP monitoring even knew it was happening." -- Head of Network Operations, EU transit operator

Install

One-liner (recommended)

curl -sSL https://flowtriq.com/install.sh | sudo bash

This handles everything: installs dependencies, installs ftagent from PyPI, runs the setup wizard, and starts the systemd service.

From PyPI

pip install ftagent[full]
sudo ftagent --setup
sudo ftagent --install-service
sudo systemctl enable --now ftagent

Either way, your node appears in the Flowtriq dashboard within 30 seconds. 14-day free trial, no credit card required.

Requirements

  • Linux (Ubuntu 20.04+, Debian 11+, CentOS 8+)
  • Python 3.8+
  • Root / sudo (for raw packet capture)
  • A Flowtriq account

From source

git clone https://github.com/flowtriq/ftagent.git
cd ftagent
pip install -e .[full]

Detection

L3/L4 (packet-level)

The agent samples PPS/BPS every second and maintains adaptive baselines with time-of-day awareness. When traffic exceeds the threshold, an incident is opened, classified, and reported within one second.

Attack families: UDP flood, SYN flood, TCP flood (ACK/RST/FIN/PSH), DNS flood, ICMP flood, protocol flood (GRE/ESP), fragment flood, multi-vector

Attack subtypes: DNS amplification, NTP amplification, SSDP, memcached, CLDAP, CharGEN, SNMP, mDNS, WS-Discovery, SYN-ACK flood, XMAS flood, NULL flood, UDP fragment flood, QUIC flood, and more

Threat intel enrichment: 481,000+ active IOCs from 26 threat feeds. When a known botnet signature (Mirai, Gafgyt, Mozi, XorDDoS, etc.) or DDoS tool (LOIC, MHDDoS, Slowloris) is matched in packet payloads, the incident is labeled with the specific tool name and confidence is boosted.

L7 (application-layer)

Tails your web server access log (nginx, Apache, Caddy, LiteSpeed, HAProxy, Node.js) and detects HTTP floods via request rate spikes, IP concentration, endpoint targeting, error rate anomalies, and bot UA percentage.

L7 subtypes: Volumetric HTTP flood, credential stuffing, API abuse, scraping, slow-rate (R.U.D.Y./Slowloris patterns), single-source abuse, HTTP/2 Rapid Reset (CVE-2023-44487), HTTP/2 SETTINGS flood, HTTP/2 CONTINUATION flood (CVE-2024-27983), QUIC flood

Threat patterns: SQLi, XSS, path traversal, RFI/LFI, WordPress probes, Shellshock, Log4j, scanner probes, CVE exploits

Baselines

Adaptive sliding-window baselines that learn your actual traffic patterns:

  • 300-sample rolling window with p99 percentile calculation
  • Time-of-day awareness with per-hour baselines (24 buckets). Off-peak hours get more sensitive thresholds, peak hours avoid false positives
  • 90-second startup grace period prevents alerts during initial learning
  • 5,000 PPS minimum floor prevents false positives on quiet servers
  • 10-tick hysteresis prevents flapping on resolution
  • IP safelists for known-good traffic sources

Mitigation

When an attack is detected, ftagent can execute mitigation automatically through a 4-tier escalation ladder:

  1. Local firewall - iptables/nftables rate limiting, SYN cookies, conntrack tuning, source blocking (27 action types + 5 kernel-level intents)
  2. BGP FlowSpec - Push flow-specification rules to upstream routers via ExaBGP, GoBGP, BIRD 2, or FRRouting
  3. BGP RTBH - Remote triggered blackhole routing for volumetric attacks
  4. Cloud scrubbing - Auto-divert to Cloudflare Magic Transit, OVH, Hetzner, AWS Shield, DigitalOcean, Vultr, or Linode/Akamai

All mitigation rules auto-undo when the incident resolves. Full audit trail in the dashboard.

PCAP forensics

Every incident gets a packet capture automatically:

  • 1,000-packet pre-attack ring buffer captures traffic from before the attack started
  • Up to 10,000 packets per incident with configurable limits
  • Auto-upload to the dashboard on incident resolution
  • In-browser PCAP viewer with packet filtering, protocol breakdown, and AI-powered analysis
  • 7-day retention (365-day on enterprise plans)
  • Capture modes: scapy (real-time per-packet) or tcpdump (kernel-speed, recommended for high-traffic nodes)

Alerting

13 notification channels with multi-step escalation policies:

Discord, Slack, PagerDuty, OpsGenie, Microsoft Teams, Telegram, email, SMS, custom webhooks, browser push, Grafana, Datadog, Prometheus

Escalation policies support per-step delays, severity-based routing, maintenance window suppression, and correlated incident deduplication.

Integrations

Category Integrations
Alert channels Discord, Slack, PagerDuty, OpsGenie, Teams, Telegram, Email, SMS, Webhooks, Grafana, Datadog, Prometheus
BGP adapters ExaBGP, GoBGP, BIRD 2, FRRouting, Cloudflare, Radware, F5, Webhook
Cloud scrubbing Cloudflare Magic Transit, OVH, Hetzner, AWS Shield, DigitalOcean, Vultr, Linode/Akamai, Cloudflare WAF
SIEM Splunk HEC, Elasticsearch, Microsoft Sentinel, Syslog CEF, Wazuh, MISP
Observability Grafana, Datadog, Prometheus
Firewall iptables, ipset, nftables, ufw, tc, fail2ban, XDP/eBPF
Flow sources sFlow v5, NetFlow v5/v9, IPFIX
Panels Pterodactyl, WHMCS

Configuration

Config file: /etc/ftagent/config.json

Key Default Description
api_key -- Required. Your Flowtriq node API key
node_uuid -- Required. Node UUID from your dashboard
interface "auto" Network interface to monitor
pcap_enabled true Enable PCAP capture during incidents
pcap_mode "tcpdump" Capture engine: "tcpdump" (recommended) or "scapy"
dynamic_threshold true Adaptive baseline detection
threshold_multiplier 3.0 Alert when PPS exceeds baseline x multiplier
heartbeat_interval 30 Seconds between heartbeats
metrics_interval 10 Seconds between metrics reports
auto_update true Auto-update from PyPI with integrity verification

Full config reference: flowtriq.com/docs

CLI

sudo ftagent [options]

  --setup            Interactive setup wizard
  --install-service  Install systemd service unit
  --config PATH      Config file path (default: /etc/ftagent/config.json)
  --test             Test API connectivity
  --tui              Terminal UI dashboard (requires 'rich')
  --version          Show version
  --update           Check for and install updates

Pricing

$9.99/node/month (or $7.99/month on annual). No activation fees, no bandwidth licensing, no contracts. All features included on every plan. 14-day free trial, no credit card required.

Flow sources from $19/mo. Mirror/SPAN from $49/mo. Full pricing.

Docs

Full documentation: flowtriq.com/docs

Support

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.9.48)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for flowtriq from gravatar.com flowtriq

Credits

Author: Flowtriq

License

Other/Proprietary License (Other/Proprietary License)

Requires

Python >=3.8

Provides Extra

full tui lite

Tags

ddos network monitoring security ids traffic detection

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ftagent-1.9.42.tar.gz (138.0 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ftagent-1.9.42-py3-none-any.whl (106.5 kB view details)

Uploaded Python 3

File details

Details for the file ftagent-1.9.42.tar.gz.

File metadata

  • Download URL: ftagent-1.9.42.tar.gz
  • Upload date:
  • Size: 138.0 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.14.0

File hashes

Hashes for ftagent-1.9.42.tar.gz
Algorithm Hash digest
SHA256 7cf2ea3d540643544f9ba6cc8d7dc57e90e577fe0ee630b984389d4604dcbd87
MD5 5aaafe3c82e2b901e5d1df4a0b461055
BLAKE2b-256 f2e48c6821825fd859920efe3acf01336d589ab0f1d1116320636330ff172b62

See more details on using hashes here.

File details

Details for the file ftagent-1.9.42-py3-none-any.whl.

File metadata

  • Download URL: ftagent-1.9.42-py3-none-any.whl
  • Upload date:
  • Size: 106.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.14.0

File hashes

Hashes for ftagent-1.9.42-py3-none-any.whl
Algorithm Hash digest
SHA256 420588e49d9c48e486b1ab866b4cdfbf045cfb5204df63129c332cc51427c306
MD5 84066cb4fa14fe10b716c435ea2dc8da
BLAKE2b-256 4d01e6f313582cddb8095616e11a6aa70eb59919a411b5ff5f307a2777f39c5c

See more details on using hashes here.

Release history Release notifications | RSS feed

1.9.48

2 files

1.9.47

2 files

1.9.46

2 files

1.9.45

2 files

1.9.44

2 files

1.9.43

2 files

This release

1.9.42 This release

2 files

1.9.41

2 files

1.9.40

2 files

1.9.39

2 files

1.9.38

2 files

1.9.37

2 files

1.9.36

2 files

1.9.35

2 files

1.9.34

2 files

1.9.33

2 files

1.9.32

2 files

1.9.31

2 files

1.9.30

2 files

1.9.29

2 files

1.9.28

2 files

1.9.27

2 files

1.9.26

2 files

1.9.25

2 files

1.9.24

2 files

1.9.23

2 files

1.9.22

2 files

1.9.21

2 files

1.9.20

2 files

1.9.19

2 files

1.9.18

2 files

1.9.17

2 files

1.9.16

2 files

1.9.15

2 files

1.9.14

2 files

1.9.13

2 files

1.9.10

2 files

1.9.9

2 files

1.9.8

2 files

1.9.7

2 files

1.9.6

2 files

1.9.5

2 files

1.9.4

2 files

1.9.3

2 files

1.9.2

2 files

1.9.1

2 files

1.9.0

2 files

1.8.6

1 file

1.8.5

1 file

1.8.4

2 files

1.8.3

2 files

1.8.2

2 files

1.8.1

2 files

1.8.0

2 files

1.7.9

2 files

1.7.8

2 files

1.7.7

2 files

1.7.6

2 files

1.7.5

2 files

1.7.4

2 files

1.7.3

2 files

1.7.2

2 files

1.7.1

2 files

1.7.0

2 files

1.6.9

2 files

1.6.8

2 files

1.6.7

2 files

1.6.6

2 files

1.6.5

2 files

1.6.4

2 files

1.6.3

2 files

1.6.2

2 files

1.6.1

2 files

1.6.0

2 files

1.5.0

2 files

1.4.6

2 files

1.4.5

2 files

1.4.4

2 files

1.4.3

2 files

1.4.2

2 files

1.4.1

2 files

1.4.0

2 files

1.3.4

2 files

1.3.3

2 files

1.3.2

2 files

1.3.1

2 files

1.3.0

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.6

2 files

1.1.5

2 files

1.1.4

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page