Please take a look at my tool for detecting ddos attacks, it uses pf_ring module and works very fast (tested up to 3 millón pacientes pero second Andes 10Gbps)

Please take a look at my tool for detecting ddos attacks, it uses pf_ring module and works very fast (tested up to 3 millón pacientes pero second Andes 10Gbps) and can trigger firewall or BGP blackhole for detecting attacked host