Skip to content

Releases: tcpsheep/Dolly-Sensor

Release list

Dolly Sensor 1.0.0

Dolly Sensor 1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@tcpsheep tcpsheep released this 26 Oct 00:59
v1.0.0
6b28e7d

First stable release of Dolly Sensor — a self-contained sFlow DDoS detection and mitigation controller.

One binary ingests sFlow v5, profiles every protected destination and external source, scores traffic, and — when armed — enforces decisions as BGP Flowspec or RTBH announcements. Written entirely against the Go standard library: no external modules, no dashboard build step, no database.

Highlights

  • sFlow ingestion — sFlow v5 over UDP with full packet decoding; sampled counts are scaled by the sampling rate so every rate and window calculation uses estimated real traffic.
  • Behavioral profiling — per-destination rate windows, long-term baselines, protocol/port mix, top sources and warm-up state; per-source reputation with trust that is earned, decays, and raises the evidence required to act. Profiles survive restarts.
  • Rules engine — standing and conditional rules with header matching (prefixes, protocol, port ranges, TCP flags, packet length, fragments, direction), payload conditions, min_sources distributed-attack guards, cooldowns, and consecutive windows. Persisted atomically, replayed after restart, managed from the dashboard or the JSON API in an explicit evaluation order.
  • Layered automatic detection — blocklist, TCP state, FTP, reputation and volumetric scoring, then a decision stage that respects trust, cooldowns, internal sources and action deduplication. Allow rules override the pipeline by design.
  • Mitigation — RFC 8955 Flowspec encoding with GE/LE range operators and fragment components, RTBH, hold-time enforcement, capability checks, reconnect/replay, and withdrawal on expiry or graceful shutdown.
  • Live dashboard — overview, protected IPs, destination detail, intelligence, inspector, connections, blocklist, rules editor with preview and drag-and-drop ordering, mitigation, and settings, all streamed over SSE.
  • Safe by default — BGP disabled (actions shown as simulated), dashboard bound to loopback, no "protect everything" mode, default routes refused as mitigation targets, mitigations always temporary.

Downloads

Platform Archive
Linux amd64 dollysensor_1.0.0_linux_amd64.tar.gz
Linux arm64 dollysensor_1.0.0_linux_arm64.tar.gz
macOS arm64 (Apple Silicon) dollysensor_1.0.0_darwin_arm64.tar.gz
macOS amd64 (Intel) dollysensor_1.0.0_darwin_amd64.tar.gz
Windows amd64 dollysensor_1.0.0_windows_amd64.zip

Each archive contains dollysensor, the sflowgen lab traffic generator, config.example.json, README.md and LICENSE. Static builds, no runtime dependencies. SHA-256 sums are in SHA256SUMS.txt.

Building from source (Go 1.23+) also works:

go build -o dollysensor ./cmd/dollysensor
go build -o sflowgen ./cmd/sflowgen

Getting started

cp config.example.json config.json
./dollysensor -check -config config.json
./dollysensor -config config.json

The dashboard serves on http://127.0.0.1:8080. See README.md and OPERATOR-TUTORIAL.md for collecting real sFlow, dry-running BGP against a lab peer, and arming mitigation on a production edge.

./dollysensor -version reports 1.0.0.

Scope

A single-operator sensor, not an inline firewall, packet capture system or complete IDS. IPv4 mitigation only (Flowspec and RTBH); IPv6 traffic is decoded and displayed. The operator remains responsible for protected prefixes, BGP policy, communities and webhook secrets.

Assets 8
Loading