Implement an open-source tool for real-time detection of DNS amplification attacks and query floods to enhance security for Pi-hole users. This tool should alert users within ~1 second and integrate with monitoring tools like Prometheus/Grafana.
If you're running Pi-hole on a Raspberry Pi or Linux box, you're exposed to DNS-based DDoS attacks (DNS amplification, query floods). Built an open-source tool to detect these attacks in real-time. **ftagent-lite** — DDoS detector that uses eBPF for kernel-level packet inspection. **Why this matters for Pi-hole users**: - Pi-hole exposes DNS (port 53) to your network - DNS amplification attacks use open resolvers to amplify traffic - Query floods can overwhelm your Pi - Early detection = early mitigation (rate limiting, block source IPs) **What it detects**: - DNS query floods (volumetric) - DNS amplification patterns (recursive queries with spoofed source) - Unusual query rates per client - UDP/ICMP/HTTP floods (if you're running other services) **Architecture**: - Runs alongside Pi-hole on the same device - eBPF kernel-level inspection (minimal overhead) - Alerts within ~1 second - Exports to Prometheus/Grafana (if you monitor) **Performance on Raspberry Pi 4**: - 200K+ packets/sec throughput - ~50MB memory footprint - ~2-5% CPU overhead **Use cases**: - Pi-hole with DNS attack detection - Home networks with exposed DNS - Self-hosted DNS resolvers - Any Linux DNS server Open source (BSD): https://github.com/flowtriq/ftagent-lite Anyone here running Pi-hole with public DNS exposure? How are you currently detecting attack patterns?