Feature Comparison
This page compares flowwler, FastNetMon Advanced, and Wanguard across the dimensions that matter most for DDoS detection and BGP mitigation deployments.
FastNetMon Advanced and Wanguard feature data is based on publicly available documentation. Items marked ? could not be confirmed and should be verified against the respective product documentation.
Detection & Escalation
How each tool measures traffic rates, applies thresholds, and decides when and how to escalate a response. Because flowwler runs independent state machines per group and per rule, multiple mitigation types (e.g. FlowSpec and blackhole) can be active simultaneously for the same victim as different escalation levels trigger independently.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| BPS threshold | ✓ | ✓ | ✓ |
| PPS threshold | ✓ | ✓ | ✓ |
| Flow-per-second (FPS) threshold | ✗ | ✓ | ✓ |
| Multi-level escalation state machine | ✓ | ✗ | ✗ |
| Alert-only level (notify without BGP action) | ✓ | ✓ | ✓ |
| Per-level hold-down timer | ✓ | ✗ | ✗ |
| Per-level escalate-after delay | ✓ | ✗ | ✗ |
| Asymmetric smoothing (fast rise / slow fall α) | ✓ | ✗ | ✗ |
| Configurable aggregation window depth | ✓ | ✓ | ✓ |
| Per-protocol / per-port rule thresholds | ✓ | Partial | ✓ |
| Carpet bomb / distributed attack detection | ✓ | ✓ | ✓ |
| Configurable min-victims for carpet bomb trigger | ✓ | ? | ? |
| Concurrent mitigations of different types per victim | ✓ | ✗ | ? |
Multi-level escalation means flowwler can progress through distinct levels (e.g. Level 1 → alert, Level 2 → FlowSpec, Level 3 → blackhole) with independent timers and hold-downs per level, each running as an independent state machine per victim IP. FastNetMon Advanced uses a single threshold-to-action model per network: when a threshold is crossed, the configured action fires directly.
Mitigation Types
The BGP-based actions available when an attack is confirmed. All types result in a BGP announcement to connected router peers.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
Host blackhole (/32 IPv4, /128 IPv6) |
✓ | ✓ | ✓ |
Subnet blackhole (auto-derived /24//48) |
✓ | ✓ | ✓ |
| FlowSpec discard | ✓ | ✓ | ✓ |
| FlowSpec rate-limit | ✓ | ✓ | ✓ |
| FlowSpec redirect to IP next-hop (RFC 7674) | ✓ | ✓ | ? |
| FlowSpec redirect to VRF (RFC 5575) | ✓ | ✓ | ? |
| Scrubbing center via subnet blackhole | ✓ | ✓ | ✓ |
| Local traffic scrubbing (packet filter) | ✗ | ✓ | ✓ |
| Dry-run mode (metrics and notifications, no BGP) | ✓ | ? | ? |
| Cap on concurrent active mitigations | ✓ | ✗ | ? |
| Dynamic FlowSpec source refresh while active | ✓ | Partial (additive rules only, no replacement) | ? |
| Consolidated FlowSpec (pattern-based for highly distributed attacks) | ✓ | ✗ | ? |
| GeoIP / country-based blocking | ✗ | ? | ✓ |
| ASN-based blocking | ✗ | ? | ✓ |
FlowSpec
BGP FlowSpec allows announcing precise traffic-matching rules to routers instead of blunt prefix blackholes, enabling surgical mitigation based on source IP, port, protocol, TCP flags, packet length, and more.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| IPv4 FlowSpec | ✓ | ✓ | ✓ |
| IPv6 FlowSpec | ✓ | ✗ | ? |
| Source IP component | ✓ | ✓ | ✓ |
| Destination IP component | ✓ | ✓ | ✓ |
| Protocol component | ✓ | ✓ | ✓ |
| Destination port component | ✓ | ✓ | ✓ |
| Source port component | ✓ | ✓ | ✓ |
| TCP flags component | ✓ | ✓ | ? |
| Fragment component | ✓ | ✓ | ? |
| Packet-length range component | ✓ †² | ✓ | ? |
| Top-N source selection by BPS | ✓ | ✓ | ✓ |
| Rule consolidation when sources exceed max-rules | ✓ | ✗ | ? |
IPv6 FlowSpec is not supported in FastNetMon Advanced. There is an open feature request.
Subnet Discovery
How each tool learns which IP prefixes to protect and which source IPs to trust or block.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| Static CIDR lists | ✓ | ✓ | ✓ |
| IRR / AS-SET prefix fetch | ✓ | ✗ | ? |
| NetBox IPAM integration | ✓ | ✗ | ? |
| HTTP/HTTPS URL prefix import | ✓ | ✗ | ? |
| BGP prefix feed (learned from a peer) | ✗ | ✓ | ✓ |
| Per-group subnet sources | ✓ | ✓ | ✓ |
| Background prefix refresh | ✓ | ? | ? |
| Source allowlist / whitelist | ✓ | ✓ | ✓ |
| Whitelist from IRR / NetBox / URL | ✓ | ✗ | ? |
| Permanent source blacklist (block regardless of volume) | ✗ | ✓ | ✓ |
Per-Group and Per-Rule Configuration
flowwler runs a fully independent escalation state machine per victim IP, per group, and per named rule. Rules within a group match on traffic type (protocol, ports, TCP flags, packet length, or subnet aggregate) and carry their own escalation ladder and mitigation type.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| Multi-level escalation per group | ✓ | ✗ | ✗ |
| Multi-level escalation per rule within a group | ✓ | ✗ | ✗ |
| Per-group escalation policy | ✓ | ✓ | ✓ |
| Per-group hold-down timer | ✓ | ✓ | ? |
| Per-group mitigation type (blackhole, FlowSpec, etc.) | ✓ | ✗ | ✓ |
| Per-group BGP route attributes (communities, AS-PATH, NO_EXPORT) | ✓ | ✓ | ? |
| Per-group notification targets | ✓ | ✗ | ? |
| Named per-protocol/port rules within a group | ✓ | Partial | ✓ |
| Independent state machine per rule | ✓ | ✗ | ✗ |
| Multiple active mitigations from one victim (group + rules simultaneously) | ✓ | ✗ | ✗ |
| Rule match criteria propagated into FlowSpec NLRI | ✓ | ✗ | ? |
| Carpet bomb rule alongside per-host rules in same group | ✓ | ✗ | ? |
Notifications
External systems notified on attack detection and state changes such as activation, escalation, hold-down, and clearance.
| Integration | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| Webhook (generic HTTP POST) | ✓ | ✓ | ✗ |
| Slack | ✓ | ✓ | ✗ |
| Telegram | ✓ | ✓ | ✗ |
| PagerDuty | ✓ | ✓ | ✗ |
| Microsoft Teams | ✓ | ✗ | ✗ |
| Prometheus Alertmanager | ✓ | Via Prometheus scrape | ✗ |
| Jira (create/update ticket) | ✓ | ✗ | ✗ |
| Zammad (create/update ticket) | ✓ | ✗ | ✗ |
| Pushover | ✓ | ✗ | ✗ |
| Email (SMTP) | ✗ | ✓ | ✓ |
| Per-target event-type filter | ✓ | ? | ✗ |
| Stable attack ID across all events (dedup key) | ✓ | ? | ✗ |
| Per-group notification targets | ✓ | ✗ | ✗ |
| Custom script / executable | ✗ | ✓ | ✓ |
Architecture & Deployment
How each tool is packaged and what flow telemetry protocols and BGP peering modes it supports.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| eBGP multihop | ✓ | ✓ | ? |
| IPv4 + IPv6 dual-stack | ✓ | Partial (no IPv6 FlowSpec) | ? |
| BGP address families offered to router peers (IPv4/IPv6 Unicast, IPv4/IPv6 FlowSpec) | ✓ | ✓ | ✓ |
| NetFlow v5 | ✓ | ✓ | ✓ |
| NetFlow v9 | ✓ | ✓ | ✓ |
| IPFIX (NetFlow v10) | ✓ | ✓ | ✓ |
| sFlow v5 | ✓ | ✓ | ✓ |
| Packet mirror / SPAN port ingestion | ✗ | ✓ | ✓ |
| Pre-built VM image | ✗ | ✓ | ? |
| Interactive router-style config CLI | ✗ | ✓ | ✗ |
Observability
Tools and integrations available for monitoring system health, inspecting active attacks, and analysing historical data.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| Prometheus metrics | ✓ | ✓ | ? |
| Per-router traffic and status metrics | ✓ | ✓ | ✓ |
| Per-group and per-victim rate metrics | ✓ | ✓ | ✓ |
| Mitigation effectiveness metrics (discard ratio) | ✓ | ✓†¹ | ? |
| REST API | ✓ | ✓ | ✓ |
| Attack history (persistent) | ✓ | ✓ | ✓ |
| Live traffic analytics | ✗ | ✓ | ✓ |
| Pre-built dashboards | ✗ | ✓ | ✓ |
| Flow-synthesized PCAP capture | ✓ | ✓ | ✓ |
| Packet-mode PCAP capture | ✗ | ✓ | ✓ |
| Web UI | ✓ | ✓ | ✓ |
| TUI client | ✓ | ✗ | ✗ |
| API definition | OpenAPI 3.0 | ? | Swagger 2.0 |
†¹ FastNetMon Advanced reads discarded-traffic counters (dropped_in_bytes/packets) from flow telemetry via the IPFIX forwardingStatus field (element 89). Cisco ASR 9000 and Nokia SR export this field natively and require no special configuration. Juniper MX does not implement forwardingStatus; it requires JunOS 15.1F7+ and a manual fcli flag (netflow_mark_zero_next_hop_and_zero_output_as_dropped) to expose discard data. Regardless of router, the field cannot distinguish traffic dropped by BGP FlowSpec from traffic dropped by ACLs or other policy — the counter reflects all drops.
†² flowwler's packet-length matching works even when the exporter reports no native MIN_PKT_LNGTH/MAX_PKT_LNGTH fields (the common case for standard NetFlow v9/IPFIX templates, MikroTik's NetFlow v5, and sFlow), by falling back to an average derived from bytes/packets for detection matching and source selection. A live FlowSpec route's own announced filter only ever uses native or operator-configured packet-length data, never a derived guess — a FlowSpec suggestion does show the derived value (marked pkt_len_approximate: true in the API and notification payloads) since an operator reviews a suggestion before it's ever applied — see PktLenRange.
Licensing & Pricing
How each product is licensed, priced, and what restrictions apply. See the Pricing & Licensing page for flowwler details.
| Feature | flowwler | FastNetMon Advanced | Wanguard |
|---|---|---|---|
| License model | Commercial, perpetual | Commercial, subscription | Commercial, subscription |
| Pricing model | Flat rate | Per bandwidth tier and number of installations | Per sensor and per filter |
| Installation restrictions | None | Yes | None (per sensor/filter, not per server) |
| Bandwidth restrictions | None | Yes | None |
| Open-source / community edition | ✗ | ✓ (limited features) | ✗ |
| Demo / trial | Time-limited binary on request | Yes | 30-day evaluation license |