{"id":113528,"date":"2024-02-11T16:02:43","date_gmt":"2024-02-11T14:02:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemy-indeksaczii-setevogo-trafika-arkime-5-0"},"modified":"2024-02-11T16:02:43","modified_gmt":"2024-02-11T14:02:46","slug":"vypusk-sistemy-indeksaczii-setevogo-trafika-arkime-5-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypusk-sistemy-indeksaczii-setevogo-trafika-arkime-5-0","title":{"rendered":"Vyd\u00e1n\u00ed syst\u00e9mu indexace s\u00ed\u0165ov\u00e9ho provozu Arkime 5.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byl vyd\u00e1n release syst\u00e9mu pro zachyt\u00e1v\u00e1n\u00ed, ukl\u00e1d\u00e1n\u00ed a indexaci s\u00ed\u0165ov\u00fdch paket\u016f Arkime 5.0, kter\u00fd poskytuje n\u00e1stroje pro vizu\u00e1ln\u00ed hodnocen\u00ed tok\u016f dat a vyhled\u00e1v\u00e1n\u00ed informac\u00ed spojen\u00fdch se s\u00ed\u0165ovou aktivitou. Projekt byl p\u016fvodn\u011b vyvinut spole\u010dnost\u00ed AOL s c\u00edlem vytvo\u0159it otev\u0159enou alternativu k komer\u010dn\u00edm platform\u00e1m pro zpracov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch paket\u016f, umo\u017e\u0148uj\u00edc\u00ed nasazen\u00ed na vlastn\u00edch serverech a schopnou \u0161k\u00e1lovat pro zpracov\u00e1n\u00ed datov\u00e9ho toku rychlostmi v des\u00edtk\u00e1ch gigabit\u016f za sekundu. K\u00f3d komponenty pro zachycov\u00e1n\u00ed dat je naps\u00e1n v jazyce C, zat\u00edmco rozhran\u00ed je realizov\u00e1no na Node.js\/JavaScript. Zdrojov\u00e9 k\u00f3dy jsou distribuov\u00e1ny pod licenc\u00ed Apache 2.0. Podporov\u00e1na je pr\u00e1ce v Linuxu a FreeBSD. Hotov\u00e9 bal\u00ed\u010dky byly p\u0159ipraveny pro Arch Linux, RHEL\/CentOS a Ubuntu. <\/p>\n

Arkime zahrnuje n\u00e1stroje pro zachyt\u00e1v\u00e1n\u00ed a indexaci dat v form\u00e1tu PCAP, a tak\u00e9 poskytuje prost\u0159edky pro rychl\u00fd p\u0159\u00edstup k proindexovan\u00fdm dat\u016fm. Pou\u017eit\u00ed standardn\u00edho form\u00e1tu PCAP zna\u010dn\u011b usnad\u0148uje integraci s existuj\u00edc\u00edmi analyz\u00e1tory dat, jako je Wireshark. Velikost ulo\u017een\u00fdch dat je omezena pouze velikost\u00ed dostupn\u00e9ho diskov\u00e9ho pole. Metadata o sezen\u00edch jsou indexov\u00e1na v clusteru na b\u00e1zi enginu Elasticsearch nebo OpenSearch. Komponenta pro zachycen\u00ed dat pracuje v multithreadov\u00e9m re\u017eimu a \u0159e\u0161\u00ed \u00fakoly monitorov\u00e1n\u00ed, ukl\u00e1d\u00e1n\u00ed PCAP dump\u016f na disk, anal\u00fdzu zachycen\u00fdch paket\u016f a odes\u00edl\u00e1n\u00ed metadata o sezen\u00edch (SPI, Stateful packet inspection) a protokolech do clusteru Elasticsearch\/OpenSearch. Mo\u017en\u00e9 je uchov\u00e1n\u00ed PCAP soubor\u016f v za\u0161ifrovan\u00e9 podob\u011b. <\/p>\n

Pro anal\u00fdzu shrom\u00e1\u017ed\u011bn\u00fdch informac\u00ed je k dispozici webov\u00e9 rozhran\u00ed, kter\u00e9 umo\u017e\u0148uje navigaci, vyhled\u00e1v\u00e1n\u00ed a export v\u00fdb\u011br\u016f. V webov\u00e9m rozhran\u00ed jsou k dispozici r\u016fzn\u00e9 re\u017eimy zobrazen\u00ed \u2014 od celkov\u00e9 statistiky, mapy propojen\u00ed a vizu\u00e1ln\u00edch graf\u016f s daty o zm\u011bn\u00e1ch v s\u00ed\u0165ov\u00e9 aktivit\u011b, a\u017e po n\u00e1stroje pro zkoum\u00e1n\u00ed jednotliv\u00fdch relac\u00ed, anal\u00fdzu aktivity podle pou\u017eit\u00fdch protokol\u016f a anal\u00fdzu dat z PCAP dump\u016f. D\u00e1le je k dispozici API, kter\u00e9 umo\u017e\u0148uje p\u0159ed\u00e1vat do t\u0159et\u00edch aplikac\u00ed data o zachycen\u00fdch paketech ve form\u00e1tu PCAP a rozebran\u00fdch relac\u00edch ve form\u00e1tu JSON.

\"Vyd\u00e1n\u00ed<\/center> <\/p>\n

V nov\u00e9 verzi: <\/p>\n