{"id":37189,"date":"2019-10-31T22:16:15","date_gmt":"2019-10-31T19:16:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\/"},"modified":"2019-10-31T22:16:15","modified_gmt":"2019-10-31T19:16:15","slug":"setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","title":{"rendered":"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks'i lahenduste abil","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/8509341060b74259e9383af1b28c1e59.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nViimasel ajal on Internetis saadaval tohutult materjale teema kohta <b>v\u00f5rgu perimeetri liikluse anal\u00fc\u00fcsist<\/b>. Samuti on k\u00f5igile kuidagi t\u00e4iesti unustatud <b>kohaliku liikluse anal\u00fc\u00fcs<\/b>, mis on sama oluline. See artikkel k\u00e4sitleb just seda teemat. N\u00e4iteks <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/flowmon\">Flowmon Networks<\/a><\/noindex> tuletame meelde vanade head Netflow'i (ja selle alternatiivide) kasutamist, vaatame huvitavaid juhtumeid, v\u00f5imalikke v\u00f5rgu ebanormaalsusi ja \u00f5pime lahenduse eeliseid, kui <b>kogu v\u00f5rk t\u00f6\u00f6tab nagu \u00fcks sensor<\/b>. Ja mis k\u00f5ige parem - sellist kohaliku liikluse anal\u00fc\u00fcsi saab t\u00e4iesti tasuta teostada prooviversiooni raames (<b>45 p\u00e4eva<\/b>). Kui teema teid huvitab, olete oodatud lugema edasi. Kui aga lugemine tundub vaevana, siis v\u00f5ib ettevaatlikult registreeruda <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">ootaval veebinaril<\/a><\/noindex>, kus me n\u00e4itame ja r\u00e4\u00e4gime k\u00f5igest (seal saab ka teada toodete koolituste kohta).<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Mis on Flowmon Networks?<\/h3>\n<p>\nEsiteks on Flowmon Euroopa IT-tootja. Ettev\u00f5te on T\u0161ehhi, peakorter asub Brnos (sanktsioonide k\u00fcsimus ei tule isegi k\u00f5ne alla). Praeguses vormis on ettev\u00f5te turul alates 2007. aastast. Enne seda oli tuntud br\u00e4ndi nimega Invea-Tech. Kokku on toodete ja lahenduste arendamiseks kulutatud peaaegu 20 aastat.<\/p>\n<p>Flowmon positsioneerib end A-klassi br\u00e4ndina. Arendab premium-taseme lahendusi ettev\u00f5tte klientidele ja on esindatud Gartneri aruandes v\u00f5rgu j\u00f5udluse j\u00e4lgimise ja diagnostika (NPMD) valdkonnas. Mis on huvitav, k\u00f5ikidest ettev\u00f5tetest aruandes on Flowmon ainus tootja, keda Gartner tunnustab nii v\u00f5rgu j\u00e4lgimise kui ka informatsiooni kaitse (Network Behavior Analysis) lahenduste tootjana. Esimese koha nad veel ei oma, kuid seet\u00f5ttu ei ole nad nii k\u00f5rge hinnaga nagu Boeing'i tiivad.<\/p>\n<h3>Milliseid \u00fclesandeid toode lahendab?<\/h3>\n<p>\nGlobaalset, saab tuvastada j\u00e4rgmised \u00fclesannete r\u00fchmad, mida ettev\u00f5tte tooted lahendavad:<\/p>\n<ol>\n<li>v\u00f5rgu ja v\u00f5rguressursside t\u00f6\u00f6 stabiilsuse suurendamine, minimeerides nende seisu ja k\u00e4ttesaamatuse aega;<\/li>\n<li>v\u00f5rgu \u00fcldise j\u00f5udluse t\u00f5stmine;<\/li>\n<li>administratiivse personali t\u00f6\u00f6 efektiivsuse suurendamine, kasutades:\n<ul>\n<li>kaasaegseid innovaatilisi v\u00f5rgu j\u00e4lgimisvahendeid, mis p\u00f5hinevad IP-voogude teabel;<\/li>\n<li> details of network operation and status analytics \u2013 users and applications operating on the network, transmitted data, interacting resources, services, and nodes;<\/li>\n<li> responding to incidents before they occur, rather than after users and clients have lost service;<\/li>\n<li> reducing the time and resources required for network and IT infrastructure administration;<\/li>\n<li> simplifying troubleshooting tasks.<\/li>\n<\/ul>\n<\/li>\n<li>increasing the security level of the network and enterprise information resources by employing non-signature technologies to detect anomalous and malicious network activity, as well as zero-day attacks;<\/li>\n<li>ensuring the required level of SLA for network applications and databases.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Flowmon Networks Product Portfolio<\/h3>\n<p>\nNow let\u2019s look directly at the Flowmon Networks product portfolio and find out what the company specifically deals with. As many have already guessed from the name, the main specialization is in solutions for flow traffic monitoring, plus a number of additional modules that expand the basic functionality.<\/p>\n<p>In fact, Flowmon can be called a one-product company, or rather \u2013 one solution. Let's figure out whether this is good or bad.<\/p>\n<p>The core of the system is a collector responsible for gathering data from various flow protocols, such as <b>NetFlow v5\/v9, jFlow, sFlow, NetStream, IPFIX<\/b>\u2026 It stands to reason that for a company not affiliated with any of the network equipment manufacturers, it is important to offer the market a universal product that is not tied to a single standard or protocol.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/d8dddeaa90c8bc03b78282b7ca00ea86.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Collector<\/i><\/p>\n<p>The collector is available both as a hardware server and as a virtual machine (VMware, Hyper-V, KVM). By the way, the hardware platform is implemented on customized DELL servers, which automatically alleviates many warranty and RMA concerns. The only proprietary hardware components are the FPGA traffic capture boards developed by Flowmon\u2019s subsidiary, which allow monitoring speeds of up to 100 Gbps.<\/p>\n<p>But what to do if the existing network equipment cannot generate quality flow? Or if the load on the equipment is too high? No problem:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/53dda0e4f42ddbf7a8add1064e0ab913.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Probe<\/i><\/p>\n<p>Selleks pakub Flowmon Networks oma probe'e (Flowmon Probe), mis \u00fchendatakse v\u00f5rku SPAN-pordi v\u00f5i passiivsete TAP-harude kaudu.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/298507c4bcb3d562f9621ff59ee6018f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>SPAN (peegelpordid) ja TAP rakendamisv\u00f5imalused<\/i><\/p>\n<p>Sellel juhul muudetakse Flowmon Probe'ile edastatav 'toores' liiklus laiendatud IPFIX-iks, mis sisaldab rohkem kui <b>240 m\u00f5\u00f5dikut teabe kohta<\/b>. Standardses NetFlow protokollis, mida genereerib v\u00f5rgusseade, on mitte rohkem kui 80 m\u00f5\u00f5dikut. See v\u00f5imaldab tagada protokollide n\u00e4htavuse mitte ainult 3. ja 4. tasandil, vaid ka 7. tasandil ISO OSI mudeli kohaselt. L\u00f5ppkokkuv\u00f5ttes saavad v\u00f5rguhaldurid j\u00e4lgida selliste rakenduste ja protokollide toimimist nagu e-mail, HTTP, DNS, SMB\u2026<\/p>\n<p>Kontekstselt n\u00e4eb s\u00fcsteemi loogiline arhitektuur v\u00e4lja j\u00e4rgmiselt:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/273517a6aa47726fe51c498114908c14.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKogu Flowmon Networks'i '\u00f6ko-s\u00fcsteemi' keskpunktiks on Collector, mis saab liiklust olemasolevatelt v\u00f5rguseadmetelt v\u00f5i oma probe'ilt (Probe). Kuid ettev\u00f5tte lahendusele oleks liiga lihtne pakkuda funktsioone ainult v\u00f5rgu liikluse j\u00e4lgimiseks. Seda oskavad teha ka avatud l\u00e4htekoodiga lahendused, kui mitte sama tootlikkusega. Flowmon'i v\u00e4\u00e4rtus peitub t\u00e4iendavates moodulites, mis laiendavad p\u00f5hifunktsionaalsust:<\/p>\n<ul>\n<li>moodul <b>Anomaalia avastamise turvalisus<\/b> \u2013 anomaalse v\u00f5rguaktiivsuse tuvastamine, sealhulgas nullp\u00e4eva r\u00fcnnakud, heuristilise liikluse anal\u00fc\u00fcsi ja t\u00fc\u00fcpilise v\u00f5rgu profiili alusel;<\/li>\n<li>moodul <b>Rakenduste Tulemuslikkuse J\u00e4lgimine<\/b> \u2013 v\u00f5rgu rakenduste tootlikkuse j\u00e4lgimine ilma agentide paigaldamiseta ja sihts\u00fcsteemidele m\u00f5ju avaldamata;<\/li>\n<li>moodul <b>Liiklusrekordi pidaja<\/b> \u2013 v\u00f5rguliikluse fragmentide salvestamine etten\u00e4htud reeglite v\u00f5i ADS-mooduli k\u00e4ivitajate kaudu edasise t\u00f5rkeotsingu ja\/v\u00f5i k\u00fcberturbe juhtumite uurimise jaoks;<\/li>\n<li>moodul <b>DDoS-kaitse<\/b> \u2013 v\u00f5rgu piiri kaitsmine mahu p\u00f5histe teenuset\u00f5kestamise DoS\/DDoS r\u00fcnnakute eest, sealhulgas rakenduste r\u00fcnnakud (OSI L3\/L4\/L7).<\/li>\n<\/ul>\n<p>\nK\u00e4esolevas artiklis vaatleme, kuidas k\u00f5ik t\u00f6\u00f6tab reaalajas kahe mooduli n\u00e4itel \u2013 <b>V\u00f5rgu t\u00f6\u00f6tluse j\u00e4lgimine ja diagnostika<\/b> ja <b>Anomaalia avastamise turvalisus<\/b>.<br \/>\nSisendisubmit:<\/p>\n<ul>\n<li>Lenovo RS 140 server koos h\u00fcperviisoriga VMware 6.0;<\/li>\n<li>Flowmon Collector'i virtuaalmasina pilt, mille saab <noindex><a rel=\"nofollow\" href=\"https:\/\/www.flowmon.com\/en\/download-free-trial\">siit alla laadida<\/a><\/noindex>;<\/li>\n<li>paar l\u00fclitit, mis toetavad voolu protokolle.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Samm 1. Flowmon Collector'i installatsioon<\/h3>\n<p>\nVirtuaalmachiini k\u00e4ivitamine VMware-s toimub t\u00e4iesti standardsel viisil OVF-mallilt. L\u00f5pptulemusena saame virtuaalmachiini, mis t\u00f6\u00f6tab CentOS-i all ja on varustatud t\u00f6\u00f6ks vajaliku tarkvaraga. Resursside n\u00f5uded on m\u00f5istlikud:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/9ae1559b01c639763e0053ee1de120ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4\u00e4nud on vaid teha p\u00f5hialustamine k\u00e4su <b>sysconfig<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/c65a47dfd025595f7256b1e30b941e42.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeadistame IP haldustasandil, DNS, aja, Hostname ja saame \u00fchendada WEB-liidesesse.<\/p>\n<h3>Samm 2. Litsentsi installimine<\/h3>\n<p>\nKaks ja poole kuu prooviversioon genereeritakse ja allalaaditakse koos virtuaalmachiini pildiga. Laadime sisse l\u00e4bi <b>Configuration Center -&gt; License<\/b>. L\u00f5pptulemusena n\u00e4eme:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/a5c1c99ad14cf4ca5dfb560d55fa369d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00f5ik on valmis. Saab alustada t\u00f6\u00f6tamist.<\/p>\n<h3>Samm 3. Vastuv\u00f5tja seadistamine kollektoris<\/h3>\n<p>\nSelles etapis tuleb otsustada, kuidas s\u00fcsteemi andmed allikatest j\u00f5uavad. Nagu varem juba mainitud, v\u00f5ib see olla \u00fcks protokollidest flow v\u00f5i SPAN-port l\u00fclitil.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/3ff1c77a58c152314a1615dd98ca92ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMeie n\u00e4ites kasutame andmete vastuv\u00f5ttu protokollide <b>NetFlow v9 ja IPFIX<\/b>. Sellisel juhul m\u00e4\u00e4rame sihtm\u00e4rgiks haldustasandi IP-aadressi \u2013 <b>192.168.78.198<\/b>. Eth2 ja eth3 liidesed (t\u00fc\u00fcbiga Monitoring interface) on m\u00f5eldud \u201etoore\u201d liikluse koopia vastuv\u00f5tmiseks l\u00fcliti SPAN-portilt. J\u00e4tame need vahele, meie juhtum ei ole.<br \/>\nSeej\u00e4rel kontrollime kollektoriporda, kuhu liiklus peaks j\u00f5udma.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/31fff2f3bfef52b001edb39bdb3293f9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMeie juhul ootab kollektor liiklust UDP\/2055 porti.<\/p>\n<h3>Samm 4. V\u00f5rguseadmete seadistamine flow eksportimiseks<\/h3>\n<p>\nNetFlow seadistamine Cisco Systems seadmetes on t\u00f5en\u00e4oliselt iga v\u00f5rgu administraatori jaoks t\u00e4iesti tavaline asi. Meie n\u00e4ites v\u00f5tame midagi veidi ebatavalisemat. N\u00e4iteks MikroTik RB2011UiAS-2HnD marsruuter. Jah, uskumatult, selline odavam lahendus v\u00e4ikestes ja kodukontorites toetab samuti NetFlow v5\/v9 ja IPFIX protokolle. Seadetes m\u00e4\u00e4rame sihtm\u00e4rgiks (kogumisse aadress 192.168.78.198 ja port 2055):<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/3604b4c1c0b013a3822e99d97ab9e9cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJa lisame k\u00f5ik kergesti saadaval olevad eksportimise metoodikad:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/f22fa921b4195b184e82c12a2b852f3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSellega v\u00f5ib \u00f6elda, et p\u00f5hiseadistus on l\u00f5petatud. Kontrollime, kas s\u00fcsteemi j\u00f5uab liiklus.<\/p>\n<h3>Samm 5. V\u00f5rguteabe ja diagnostika mooduli kontrollimine ja kasutamine<\/h3>\n<p>\nAllika liikluse olemasolu saab kontrollida jaotises <b>Flowmon Monitoring Center -&gt; Sources<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/b167ac4ba70c07d9d0fb521a1cf1a7ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e4eme, et andmed j\u00f5uavad s\u00fcsteemi. M\u00f5ne aja p\u00e4rast, kui kollektor on liiklust kogunud, hakkavad vidinad kuvama teavet:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/8cee4912c371366ff30ff7597f87cabc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nS\u00fcsteem on \u00fcles ehitatud drill down printsiipe j\u00e4rgides. See t\u00e4hendab, et kasutaja, valides skeemil v\u00f5i graafikul endale huvipakkuva frantsi, \"kaevub\" nende andmete s\u00fcgavusele, mis talle on vajalik:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/1caa3b3c59dcd77210f690606a16740f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuni teabe saamiseni iga v\u00f5rgu\u00fchenduse ja \u00fchenduse kohta:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/ef8c8f4d2df0ae65b94fcc3be058099b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Samm 6. Anomaaliate Tuvamise Turvamoodul<\/h3>\n<p>\nSeda moodulit v\u00f5ib pidada ilmselt \u00fcheks k\u00f5ige huvitavamaks, kuna see kasutab allkirja p\u00f5hiseid meetodeid anomaaliate tuvastamiseks v\u00f5rguliikluses ja kahjulikus v\u00f5rguaktiivsuses. Kuid see ei ole IDS\/IPSi s\u00fcsteemide analoog. Mooduliga t\u00f6\u00f6tamine algab selle \"\u00f5petamisest\". Selleks m\u00e4rgitakse spetsiaalses wizardis k\u00f5ik v\u00f5tme komponendid ja teenused, sealhulgas:<\/p>\n<ul>\n<li>l\u00e4htepunktide, DNS-i, DHCP ja NTP serverite aadressid,<\/li>\n<li>aadressid kasutajate ja serverite segmentides.<\/li>\n<\/ul>\n<p>\nP\u00e4rast seda l\u00e4heb s\u00fcsteem \u00f5ppere\u017eiimi, mis kestab keskmiselt 2 n\u00e4dalat kuni 1 kuu. Selle aja jooksul loob s\u00fcsteem meie v\u00f5rgu iseloomuliku liikluse aluse. Teisis\u00f5nu, s\u00fcsteem \u00f5pib:<\/p>\n<ul>\n<li>milline k\u00e4itumine on iseloomulik v\u00f5rgu s\u00f5lmedele?<\/li>\n<li>millised andmehulga \u00fclekanded on normaalsed v\u00f5rgu jaoks?<\/li>\n<li>milline t\u00f6\u00f6aeg on t\u00fc\u00fcpiline kasutajatele?<\/li>\n<li>millised rakendused t\u00f6\u00f6tavad v\u00f5rgus?<\/li>\n<li>ja palju muud..<\/li>\n<\/ul>\n<p>\nL\u00f5pptulemusena saame t\u00f6\u00f6riista, mis tuvastab meie v\u00f5rgus mistahes anomaaliad ja k\u00f5rvalekalded iseloomulikust k\u00e4itumisest. Siin on paar n\u00e4idet, mida s\u00fcsteem suudab tuvastada:<\/p>\n<ul>\n<li>uue kahjuliku tarkvara leviku v\u00f5rgu kaudu, mida viiruset\u00f5rjed ei suuda tuvastada;<\/li>\n<li>DNS-i, ICMP v\u00f5i teiste tunnelite loomine ning andmete edastamine l\u00e4bi tulem\u00fc\u00fcri;<\/li>\n<li>uue arvuti ilmumine v\u00f5rku, mis esitleb end DHCP ja\/v\u00f5i DNS serverina.<\/li>\n<\/ul>\n<p>\nVaatame, kuidas see elavas vormis v\u00e4lja n\u00e4eb. P\u00e4rast seda, kui teie s\u00fcsteem on l\u00e4binud koolituse ja loonud v\u00f5rgu liikluse aluse, hakkab ta tuvastama s\u00fcndmusi:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/e4d7d168716fc9f703dd9f14faf5816f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMooduli avaleht \u2013 ajagraafik, kus kuvatakse tuvastatud s\u00fcndmusi. Meie n\u00e4ites n\u00e4eme selgelt t\u00f5usu, umbes kella 9 ja 16 vahel. T\u00f5stame esile ja vaatame l\u00e4hemalt. <\/p>\n<p>Selgelt on n\u00e4ha r\u00fcndaja ebanormaalset k\u00e4itumist v\u00f5rgus. K\u00f5ik algab sellest, et host aadressiga 192.168.3.225 alustas horisontaalset skaneerimist v\u00f5rgu kaudu port 3389 (Microsoft RDP teenus) ja leiab 14 potentsiaalset \"ohvrit\":<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/5844fab428bd7adedbc694bf7dc7f19e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nja<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/566cb37c28eb803d404e06a8d61372c3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4rgmist fikseeritud intsidenti \u2013 host 192.168.3.225 alustab j\u00f5hkrat j\u00f5uloojutust RDP teenuse (port 3389) paroolide proovimise r\u00fcnnakut varem tuvastatud aadresside suhtes:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/18c97646b3982c5a9db86901cae9f5a7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nR\u00fcnnaku tulemusena fikseeriti \u00fchel r\u00fcnnatud hostist SMTP anomaalia. Teisis\u00f5nu, alustati r\u00e4mpsposti saatmist:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rguj\u00e4relevalve ja ebanormaalsete v\u00f5rguaktiivsuste avastamine Flowmon Networks&#039;i lahenduste abil\" src=\"\/wp-content\/uploads\/2019\/08\/fd1fce3c9bb23903a3c54d270924c5fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAntud n\u00e4ide on selge demonstratsioon s\u00fcsteemi ja Anomaly Detection Security mooduli toimimisv\u00f5imetest. Efektiivsuse hindamine j\u00e4\u00e4b teie endi otsustada. Sellega l\u00f5petame lahenduse funktsionaalset \u00fclevaadet.<\/p>\n<h3>Kokkuv\u00f5te<\/h3>\n<p>\nKokkuv\u00f5tteks, milliseid j\u00e4reldusi saame Flowmoni kohta teha:<\/p>\n<ul>\n<li>Flowmon on premium taseme lahendus ettev\u00f5tte klientidele;<\/li>\n<li>t\u00e4nu universaalsusele ja \u00fchilduvusele on andmete kogumine saadaval mis tahes allikatest: v\u00f5rgu seadmetest (Cisco, Juniper, HPE, Huawei\u2026) v\u00f5i oma sondidest (Flowmon Probe);<\/li>\n<li>lahenduse skaleerimisv\u00f5imalused v\u00f5imaldavad s\u00fcsteemi funktsionaalsust suurendada uute moodulite lisamisega, samuti t\u00f5sta sooritust paindliku litsentsimise l\u00e4henemise kaudu;<\/li>\n<li>ainult seel\u00e4bi, et kasutatakse allkirjastamata anal\u00fc\u00fcsi tehnoloogiaid, suudab s\u00fcsteem avastada isegi tuntusele teadaolevaid ja IDS\/IPS s\u00fcsteemidele v\u00f5\u00f5raid nullp\u00e4eva r\u00fcnnakuid;<\/li>\n<li>t\u00e4nu t\u00e4ielikule \"l\u00e4bipaistvusele\" s\u00fcsteemi paigaldamisel ja kohalolekul v\u00f5rgus \u2013 lahendus ei m\u00f5juta teiste s\u00f5lmede ja teie IT infrastruktuuri komponentide t\u00f6\u00f6d;<\/li>\n<li>Flowmon on ainus turul olev lahendus, mis toetab liikluse j\u00e4lgimist kiirusel kuni 100 Gbit\/s;<\/li>\n<li>Flowmon on lahendus igasuguste v\u00f5rkude jaoks;<\/li>\n<li>parim hind \/ funktsionaalsuse suhe sarnaste lahenduste seas.<\/li>\n<\/ul>\n<p>\nSelles \u00fclevaates vaatlesime v\u00e4hem kui 10% lahenduse \u00fcldfunktsionaalsusest. J\u00e4rgmises artiklis r\u00e4\u00e4gime \u00fclej\u00e4\u00e4nud Flowmon Networks moodulitest. N\u00e4itena rakenduse j\u00f5udluse j\u00e4lgimise moodulist n\u00e4itame, kuidas \u00e4ri rakenduste administraatorid saavad tagada saadavuse m\u00e4\u00e4ratud SLA tasemel ning maksimaalselt kiiresti diagnoosida probleeme.<\/p>\n<p>Samuti kutsume teid meie veebinarile (10.09.2019), mis k\u00e4sitleb Flowmon Networks'i lahendusi. Eelregistreerimiseks palume teil <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">registreerida siin<\/a><\/noindex>.<br \/>\nSellega on k\u00f5ik, ait\u00e4h teie huvi eest!<\/p>\n<p class=\"for_users_only_msg\">Ainult registreeritud kasutajad saavad k\u00fcsitluses osaleda. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/auth\/login\/\">Logige sisse<\/a><\/noindex>, palun.<\/p>\n<h2 class=\"default-block__polling-title\">Kas kasutate Netflow'd v\u00f5rgu j\u00e4lgimiseks?<\/h2>\n<ul class=\"content-list content-list_polling\">\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Jah<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ei, kuid kavatsen<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ei<\/p>\n<\/li>\n<\/ul>\n<p>    H\u00e4\u00e4letas 9 kasutajat. 3 kasutajat pidurdusid.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/463625\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27883,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u00f5rguj\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks lahendustega | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:15+00:00","article:modified_time":"2019-10-31T19:16:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37189","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:32:13","updated":"2026-01-23 16:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37189"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27883"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}