{"id":37189,"date":"2019-10-31T22:16:15","date_gmt":"2019-10-31T19:16:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\/"},"modified":"2019-10-31T22:16:15","modified_gmt":"2019-10-31T19:16:15","slug":"setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","title":{"rendered":"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks'i lahenduste abil.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/8509341060b74259e9383af1b28c1e59.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nViimasel ajal on internetis saadaval suur hulk materjale teema kohta <b>v\u00f5rgu perimeetri liikluse anal\u00fc\u00fcsist<\/b>. Sellegipoolest on k\u00f5ik kuidagi t\u00e4iesti unustanud <b>kohaliku liikluse anal\u00fc\u00fcsi<\/b>, mis on samuti sama oluline. Antud artikkel k\u00e4sitleb just seda teemat. Flowmon Networks'i n\u00e4itel <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/flowmon\">kutsume me meelde vana hea Netflow (ja selle alternatiivid), vaatame huvitavaid juhtumeid, v\u00f5imalikke anomaaliaid v\u00f5rgus ja selgitame lahenduse eeliseid, kui<\/a><\/noindex> kogu v\u00f5rk t\u00f6\u00f6tab nagu \u00fcks sensor <b>. Ja mis k\u00f5ige t\u00e4htsam \u2014 taolist kohaliku liikluse anal\u00fc\u00fcsi on v\u00f5imalik teha t\u00e4iesti tasuta, prooviversiooni raames (<\/b>45 p\u00e4eva<b>). Kui teema huvitab, siis olete teretulnud lugema edasi. Kui lugemine tundub liiga vaevav, siis v\u00f5ib juba eelnevalt registreeruda<\/b>j\u00e4rgmisele veebiseminarile <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">, kus me n\u00e4itame ja r\u00e4\u00e4gime k\u00f5igest (seal saab ka kuulda kingitustest tootele).<\/a><\/noindex>Mis on Flowmon Networks?<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Mis on Flowmon Networks?<\/h3>\n<p>\nEsiteks, Flowmon on Euroopa IT-ettev\u00f5te. Ettev\u00f5te on T\u0161ehhi p\u00e4ritolu, desaadik Brnos (k\u00fclade sanktsioonide k\u00fcsimust ei t\u00f5statata). Omandatud kujul on ettev\u00f5te turul olnud alates 2007. aastast. Enne seda oli see tuntud nime all Invea-Tech. Nii et toote ja lahenduste arendamiseks on kulutatud peaaegu 20 aastat.<\/p>\n<p>Flowmon positsioneerib end A-klassi br\u00e4ndina. See arendab k\u00f5rgekvaliteedilisi lahendusi ettev\u00f5tte klientidele ning on esindatud Gartneri ruutudes valdkonnas Network Performance Monitoring and Diagnostics (NPMD). Mis on huvitav, Flowmon on ainus ettev\u00f5te raportis, mida Gartner on tunnustanud nii v\u00f5rguhalduse lahenduste kui ka teabe kaitse (Network Behavior Analysis) tootjana. Esimest kohta ta veel ei oma, kuid selline positsioon ei pea olema nagu Boeing\u2019i tiib.<\/p>\n<h3>Milliseid \u00fclesandeid toode lahendab?<\/h3>\n<p>\nGlobaalsete \u00fclesannete hulka kuuluvad j\u00e4rgmised probleemid, mida ettev\u00f5tte tooted suudavad lahendada:<\/p>\n<ol>\n<li>v\u00f5rgut\u00f5hususe ja ressursside stabiilsuse t\u00f5stmine, minimeerides nende seiskumise ja k\u00e4ttesaamatuse aega;<\/li>\n<li>v\u00f5rgu \u00fcldise j\u00f5udluse t\u00f5stmise.<\/li>\n<li>administratiivpersonali t\u00f6\u00f6 efektiivsuse t\u00f5stmine, mille kaudu:\n<ul>\n<li>kaasaegsete innovatiivsete v\u00f5rgumonitoringu t\u00f6\u00f6riistade kasutamine, mis p\u00f5hinevad IP voogude teabel;<\/li>\n<li> \u00fcksikasjaliku anal\u00fc\u00fcsi pakkumine v\u00f5rgufunktsiooni ja -seisundi kohta \u2013 kasutajate ja rakenduste, mis t\u00f6\u00f6tavad v\u00f5rgus, edastatud andmete, omavahel suhtlevate ressursside, teenuste ja s\u00f5lmede;<\/li>\n<li> intsidendi ennetamine enne, kui need juhtuvad, mitte p\u00e4rast teenuse kadu kasutajate ja klientide poolt;<\/li>\n<li> v\u00f5rguhalduse ja IT-infrastruktuuri haldamiseks vajaliku aja ja ressursside v\u00e4hendamine;<\/li>\n<li> veak\u00fcmblatuse otsimise \u00fclesannete lihtsustamine.<\/li>\n<\/ul>\n<\/li>\n<li>organisatsiooni v\u00f5rgu ja infovarade kaitsetaseme t\u00f5stmine, kasutades allkirjata tehnoloogiaid anomaalse ja pahatahtliku v\u00f5rguaktiivsuse, sealhulgas null-p\u00e4eva r\u00fcnnakute tuvastamiseks;<\/li>\n<li>v\u00f5rgurakenduste ja andmebaaside n\u00f5utava SLA taseme tagamine.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Flowmon Networks'i tooteportfell<\/h3>\n<p>\nN\u00fc\u00fcd vaatame l\u00e4hemalt Flowmon Networks'i tooteportfellile ja saame teada, millega t\u00e4pselt ettev\u00f5te tegeleb. Nagu paljud on juba nime p\u00f5hjal arvata v\u00f5inud, on peamine spetsialiseerumine seotud voogude (flow) monitorimise lahendustega, lisaks rida t\u00e4iendavaid mooduleid, mis laiendavad p\u00f5hifunktsioone.<\/p>\n<p>Tegelikult v\u00f5ib Flowmonit nimetada \u00fche tootega, t\u00e4psemalt \u00fche lahendusega ettev\u00f5tteks. Uurime, kas see on hea v\u00f5i halb.<\/p>\n<p>S\u00fcsteemi tuum on kollektoor, mis vastutab andmete kogumise eest erinevate flow protokollide kaudu, nagu <b>NetFlow v5\/v9, jFlow, sFlow, NetStream, IPFIX<\/b>\u2026 On t\u00e4iesti loogiline, et ettev\u00f5tte jaoks, mis ei ole seotud \u00fchegi v\u00f5rguvarustuse tootjaga, on oluline pakkuda turule universaalset toodet, mis ei ole seotud \u00fchegi kindla standardi v\u00f5i protokolliga.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/d8dddeaa90c8bc03b78282b7ca00ea86.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Collector<\/i><\/p>\n<p>Kollektiiv ilmub nii f\u00fc\u00fcsilise serverina kui ka virtuaalmasinana (VMware, Hyper-V, KVM). F\u00fc\u00fcsiline platvorm on realizeeritud kohandatud DELL serveritel, mis v\u00f5imaldab automaatselt eemaldada suure osa k\u00fcsimustest garantii ja RMA osas. Ainult FPGA liiklusvoogude salvestamise kaardid, mille on v\u00e4lja t\u00f6\u00f6tanud t\u00fctarfirma Flowmon, v\u00f5imaldavad j\u00e4lgimist kiirusel kuni 100 Gbps.<\/p>\n<p>Aga mis siis, kui olemasoleval v\u00f5rguvarustusel ei ole kvaliteetse flou generatsiooni v\u00f5imalust? V\u00f5i on varustusele liiga suur koormus? Pole probleemi:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/53dda0e4f42ddbf7a8add1064e0ab913.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Probe<\/i><\/p>\n<p>Sel juhul pakub Flowmon Networks kasutada oma sondid (Flowmon Probe), mis \u00fchendatakse v\u00f5rku l\u00fcliti SPAN-pordi v\u00f5i passiivsete TAP harude kaudu.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/298507c4bcb3d562f9621ff59ee6018f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>SPAN (peegelport) ja TAP rakenduse variandid<\/i><\/p>\n<p>Sel juhul muudetakse Flowmon Probe'ile tulev \"toores\" liiklus t\u00e4iendatud IPFIX-iks, mis sisaldab rohkem kui <b>240 m\u00f5\u00f5dikut koos teabega<\/b>. Kui tavalises NetFlow protokollis, mida genereerib v\u00f5rgu infrastruktuur, on mitte rohkem kui 80 m\u00f5\u00f5dikut. See v\u00f5imaldab tagada protokollide n\u00e4htavuse mitte ainult 3. ja 4. tasemel, vaid ka 7. tasemel ISO OSI mudelis. L\u00f5ppkokkuv\u00f5ttes saavad v\u00f5rguadministraatorid j\u00e4lgida selliste rakenduste ja protokollide toimimist nagu e-posti, HTTP, DNS, SMB...<\/p>\n<p>Konceptsiooniliselt n\u00e4eb s\u00fcsteemi loogiline arhitektuur v\u00e4lja j\u00e4rgmine:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/273517a6aa47726fe51c498114908c14.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKogu Flowmon Networks'i \"\u00f6kos\u00fcsteemi\" keskne osa on Collector, mis saab liiklust olemasolevast v\u00f5rgu varustusest v\u00f5i enda sondidest (Probe). Kuid Enterprise lahenduste puhul oleks liiga lihtne pakkuda funktsionaalsust ainult v\u00f5rgu liikluse j\u00e4lgimiseks. Selle suudavad teha ka avatud l\u00e4htekoodiga lahendused, kuigi mitte sama efektiivselt. Flowmon'i v\u00e4\u00e4rtus peitub t\u00e4iendavates moodulites, mis laiendavad p\u00f5hifunktsionaalsust:<\/p>\n<ul>\n<li>mooduli <b>Anomaly Detection Security<\/b> \u2013 anomaalse v\u00f5rguaktiivsuse tuvastamine, sealhulgas 'nullp\u00e4eva' r\u00fcnnakud, heuristilise liikluse anal\u00fc\u00fcsi ja t\u00fc\u00fcpilise v\u00f5rgu profiili alusel;<\/li>\n<li>mooduli <b>Rakenduste j\u00f5udluse j\u00e4lgimine<\/b> \u2013 v\u00f5rgu rakenduste j\u00f5udluse j\u00e4lgimine ilma \u00abagentide\u00bb installimiseta ja sihts\u00fcsteemide h\u00e4irimiseta;<\/li>\n<li>mooduli <b>Traffic Recorder<\/b> \u2013 v\u00f5rguliikluse fragmentide registreerimine etten\u00e4htud reeglite v\u00f5i ADS mooduli k\u00e4ivitaja p\u00f5hjal, edasiseks t\u00f5rkeotsinguks ja\/v\u00f5i turvainfode uurimiseks;<\/li>\n<li>mooduli <b>DDoS Protection<\/b> \u2013 v\u00f5rgu piiri kaitsmine DoS\/DDoS mahtude r\u00fcnnakute eest, sealhulgas rakenduste r\u00fcnnakute eest (OSI L3\/L4\/L7).<\/li>\n<\/ul>\n<p>\nSelles artiklis vaatleme, kuidas k\u00f5ik t\u00f6\u00f6tab otse kahe mooduli n\u00e4itel \u2013 <b>Network Performance Monitoring and Diagnostics<\/b> ja <b>Anomaly Detection Security<\/b>.<br \/>\nAlgandmed:<\/p>\n<ul>\n<li>Lenovo RS 140 server koos VMware 6.0 h\u00fcpervisoriga;<\/li>\n<li>Flowmon Collectori virtuaalmasina pilt, mille saab <noindex><a rel=\"nofollow\" href=\"https:\/\/www.flowmon.com\/en\/download-free-trial\">siit alla laadida<\/a><\/noindex>;<\/li>\n<li>paarlennukit, mis toetavad vooge.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Samme 1. Flowmon Collectori installatsioon<\/h3>\n<p>\nVirtuaalmasina k\u00e4itamine VMware'is toimub t\u00e4iesti standardse viisi j\u00e4rgi OVF malli p\u00f5hjal. L\u00f5pptulemusena saame virtuaalmasina, mis t\u00f6\u00f6tab CentOS-l ja millel on valmis tarkvara. Ressursin\u00f5uded \u2013 inimlikud:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/9ae1559b01c639763e0053ee1de120ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEi j\u00e4\u00e4 muud \u00fcle, kui t\u00e4ita baasi algseade k\u00e4su <b>sysconfig<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/c65a47dfd025595f7256b1e30b941e42.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSeame IP haldamisportile, DNS, aja, Hostname ja saame \u00fchenduda veebiliidese kaudu.<\/p>\n<h3>Samme 2. Litsentsi installatsioon<\/h3>\n<p>\nKaks ja pool kuud kehtiv prooviversioon genereeritakse ja allalaaditakse koos virtuaalmasina pildiga. Laaditakse \u00fcles kaudu <b>Configuration Center -&gt; License<\/b>. Tulemuseks on:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/a5c1c99ad14cf4ca5dfb560d55fa369d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00f5ik on valmis. Saame alustada t\u00f6\u00f6d.<\/p>\n<h3>Samm 3. Vastuv\u00f5tja seadistamine kogujal<\/h3>\n<p>\nSelles etapis tuleb otsustada, kuidas s\u00fcsteemi toovad andmed allikatest. Nagu me varem mainisime, v\u00f5ib see olla \u00fcks flow protokollidest v\u00f5i SPAN port vahetajas.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/3ff1c77a58c152314a1615dd98ca92ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMeie n\u00e4ites kasutame andmete vastuv\u00f5ttu protokollide kaudu <b>NetFlow v9 ja IPFIX<\/b>. Sel juhul m\u00e4\u00e4rame sihtm\u00e4rgiks juhtimise liidese IP-aadressi \u2013 <b>192.168.78.198<\/b>. Liidesed eth2 ja eth3 (t\u00fc\u00fcp Monitoring interface) kasutatakse vahetaja SPAN pordilt \u201etoore\u201d liikluse koopia vastuv\u00f5tmiseks. J\u00e4tame need vahele, see ei ole meie juhtum.<br \/>\nSeej\u00e4rel kontrollime kogumisporti, kuhu liiklus peab j\u00f5udma.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/31fff2f3bfef52b001edb39bdb3293f9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMeie n\u00e4ites ootab koguja liiklust UDP\/2055 pordil.<\/p>\n<h3>Samm 4. V\u00f5rgu seadmete seadistamine flow eksportimiseks<\/h3>\n<p>\nNetFlow seadistamine Cisco Systems'i varustuses on t\u00f5en\u00e4oliselt iga v\u00f5rguadministraatori jaoks t\u00e4iesti tavaline tegevus. Meie n\u00e4ites v\u00f5tame midagi ebatavalisemat. N\u00e4iteks ruuter MikroTik RB2011UiAS-2HnD. Jah, kummalisel kombel toetab ka see eelarveline lahendus v\u00e4ikeste ja kodukontorite jaoks protokolle NetFlow v5\/v9 ja IPFIX. Seadistustes m\u00e4\u00e4rame sihtm\u00e4rgi (kogumise aadress 192.168.78.198 ja port 2055):<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/3604b4c1c0b013a3822e99d97ab9e9cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJa lisame k\u00f5ik saadaval olevad ekspordimetriigid:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/f22fa921b4195b184e82c12a2b852f3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSelle v\u00f5ib \u00f6elda, et p\u00f5hiseadistamine on l\u00f5petatud. Kontrollime, kas s\u00fcsteemi voolab liiklus.<\/p>\n<h3>Samm 5. Network Performance Monitoring and Diagnostics mooduli kontroll ja kasutuselev\u00f5tt<\/h3>\n<p>\nKontrollida saab allika liiklust jaotisest <b>Flowmon Monitoring Center \u2013&gt; Sources<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/b167ac4ba70c07d9d0fb521a1cf1a7ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00e4eme, et andmed voolavad s\u00fcsteemi. M\u00f5ne aja p\u00e4rast, kui koguja on liiklust kogunud, hakkavad vidinad kuvama teavet:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/8cee4912c371366ff30ff7597f87cabc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nS\u00fcsteem on ehitatud drill down p\u00f5him\u00f5ttel. See t\u00e4hendab, et kasutaja, valides skeemil v\u00f5i graafikul end teda huvitava osa, \"sukeldub\" andmete s\u00fcgavusele, mis talle vajalik:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/1caa3b3c59dcd77210f690606a16740f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuni iga v\u00f5rgu\u00fchenduse ja \u00fchenduse teabeni:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/ef8c8f4d2df0ae65b94fcc3be058099b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Samm 6. Anomaaliate tuvastamise turvemoodul<\/h3>\n<p>\nSeda moodulit v\u00f5ib pidada \u00fcheks huvitavamaks t\u00e4nu allkirjata anomaaliate tuvastamise meetodite kasutamisele v\u00f5rguliikluses ja pahatahtlikus v\u00f5rguaktiivsuses. Kuid see ei ole IDS\/IPSi s\u00fcsteemide analoog. Mooduliga t\u00f6\u00f6tamine algab selle '\u00f5petamisest'. Selleks kasutatakse spetsiaalset viisi, mille k\u00e4igus m\u00e4\u00e4ratakse k\u00f5ik v\u00f5rgukomponendid ja -teenused, sealhulgas:<\/p>\n<ul>\n<li>v\u00e4ravade, DNS, DHCP ja NTP serverite aadresse,<\/li>\n<li>kasutajate ja serverite segmentide aadresside m\u00e4\u00e4ratlemist.<\/li>\n<\/ul>\n<p>\nP\u00e4rast seda l\u00e4heb s\u00fcsteem \u00f5ppere\u017eiimi, mis kestab keskmiselt 2 n\u00e4dalat kuni 1 kuu. Selle aja jooksul moodustab s\u00fcsteem meie v\u00f5rgu jaoks iseloomuliku liikluse aluse. Lihtsalt \u00f6eldes, s\u00fcsteem \u00f5pib:<\/p>\n<ul>\n<li>milline k\u00e4itumine on iseloomulik v\u00f5rgu solgudele?<\/li>\n<li>millised andmehulga edastused on v\u00f5rgu jaoks normaalsed?<\/li>\n<li>milline t\u00f6\u00f6aeg on kasutajatele t\u00fc\u00fcpiline?<\/li>\n<li>millised rakendused t\u00f6\u00f6tavad v\u00f5rgus?<\/li>\n<li>ja palju muud.<\/li>\n<\/ul>\n<p>\nL\u00f5ppkokkuv\u00f5ttes saame t\u00f6\u00f6riista, mis tuvastab meie v\u00f5rgus k\u00f5ik anomaaliad ja k\u00f5rvalekalded iseloomulikust k\u00e4itumisest. Siin on paar n\u00e4idet, mida s\u00fcsteem suudab tuvastada:<\/p>\n<ul>\n<li>uue pahavara levik, mis ei ole tuvastatav viiruset\u00f5rje signatuuride abil;<\/li>\n<li>DNS, ICMP v\u00f5i muu tunnelite loomine ja andmete edastamine tulem\u00fc\u00fcri kaudu;<\/li>\n<li>uue arvuti ilmumine v\u00f5rku, mis esindab end DHCP ja\/v\u00f5i DNS serverina.<\/li>\n<\/ul>\n<p>\nVaatame, kuidas see reaalajas v\u00e4lja n\u00e4eb. P\u00e4rast seda, kui teie s\u00fcsteem on \u00f5ppeprotsessi l\u00e4binud ja loonud v\u00f5rgu liikluse aluse ideaali, hakkab see tuvastama intsidente:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/e4d7d168716fc9f703dd9f14faf5816f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nModuli peamine leht \u2013 ajagraafik, kus kuvatakse tuvastatud intsidente. Meie n\u00e4ites on selgelt n\u00e4htav terav t\u00f5us, umbes kella 9 ja 16 vahel. T\u00f5stame selle esile ja vaatame l\u00e4hemalt. <\/p>\n<p>On selgelt j\u00e4lgitav r\u00fcndaja ebanormaalne k\u00e4itumine v\u00f5rgus. K\u00f5ik algab sellest, et host aadressiga 192.168.3.225 alustab horisontaalset skaneerimist portaali 3389 (Microsoft RDP teenus) ja leiab 14 potentsiaalset \"ohvrit\":<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/5844fab428bd7adedbc694bf7dc7f19e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nja<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/566cb37c28eb803d404e06a8d61372c3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4rgmine registreeritud intsident \u2013 host 192.168.3.225 alustab RDP (port 3389) paroolide bruteforce r\u00fcnnakut varem tuvastatud aadressidel:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/18c97646b3982c5a9db86901cae9f5a7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nR\u00fcnnaku tulemusena \u00fchel neist h\u00e4kitud hostidest registreeritakse SMTP ebanormaalsus. Teisis\u00f5nu, on alanud r\u00e4mpsposti saatmine:<\/p>\n<p><img decoding=\"async\" alt=\"V\u00f5rgu j\u00e4lgimine ja ebanormaalse v\u00f5rguaktiivsuse tuvastamine Flowmon Networks&#039;i lahenduste abil.\" src=\"\/wp-content\/uploads\/2019\/08\/fd1fce3c9bb23903a3c54d270924c5fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSee n\u00e4ide on s\u00fcsteemi ja Anomaly Detection Security mooduli v\u00f5imaluste visuaalne esitlus. Tehke ise j\u00e4reldusi efektiivsuse kohta. Selle funktsionaalse \u00fclevaate lahendusest l\u00f5petame.<\/p>\n<h3>Kokkuv\u00f5te<\/h3>\n<p>\nKokkuv\u00f5ttes, millised j\u00e4reldused Flowmoni kohta saame teha?<\/p>\n<ul>\n<li>Flowmon on tippklassi lahendus ettev\u00f5tete kliendile;<\/li>\n<li>t\u00e4nu universaalsusele ja \u00fchilduvusele on andmete kogumine saadaval k\u00f5igilt allikatelt: v\u00f5rgusseadmest (Cisco, Juniper, HPE, Huawei...) v\u00f5i oma sondidest (Flowmon Probe);<\/li>\n<li>lahenduse skaleerimisv\u00f5ime v\u00f5imaldab s\u00fcsteemi funktsionaalsust laiendada, lisades uusi mooduleid, ja suurendada j\u00f5udlust paindliku litsentsimise l\u00e4henemise abil;<\/li>\n<li>signatureless anal\u00fc\u00fcsitehnoloogiate kasutamise t\u00f5ttu v\u00f5imaldab s\u00fcsteem tuvastada isegi viiruset\u00f5rje ja IDS\/IPS s\u00fcsteemidele tundmatuid zero-day r\u00fcnnakuid;<\/li>\n<li>t\u00e4nu t\u00e4ielikule \"l\u00e4bipaistvusele\" seadistamise ja s\u00fcsteemi kohaloleku osas v\u00f5rgus \u2013 lahendus ei m\u00f5juta teiste s\u00f5lmede ja teie IT infrastruktuuri komponentide t\u00f6\u00f6d.<\/li>\n<li>Flowmon \u2013 ainus turul olev lahendus, mis toetab liikluse j\u00e4lgimist kiirusel kuni 100 Gbit\/s;<\/li>\n<li>Flowmon \u2013 lahendus igasuguste v\u00f5rkude jaoks;<\/li>\n<li>parim hinna ja funktsionaalsuse suhe sarnaste lahenduste seas.<\/li>\n<\/ul>\n<p>\nSelles \u00fclevaates k\u00e4sitleme v\u00e4hem kui 10% lahenduse kogufunktsioonidest. J\u00e4rgmises artiklis r\u00e4\u00e4gime \u00fclej\u00e4\u00e4nud Flowmon Networks moodulitest. N\u00e4itena rakenduse j\u00f5udluse j\u00e4lgimise moodulist n\u00e4itame, kuidas \u00e4rirakenduste administraatorid saavad tagada SLA kehtestatud tasemel k\u00e4ttesaadavuse ning v\u00f5imalikult kiiresti probleeme diagnoosida.<\/p>\n<p>Samuti tahame Teid kutsuda meie veebinarile (10.09.2019), mis on p\u00fchendatud Flowmon Networks'i lahendustele. Ette registreerimiseks palume Teil <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">registreeruda siin<\/a><\/noindex>.<br \/>\nSellega j\u00e4tame t\u00e4naseks l\u00f5petuseks, ait\u00e4h Teie huvi eest!<\/p>\n<p class=\"for_users_only_msg\">Ainult registreeritud kasutajad saavad k\u00fcsitluses osaleda. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/auth\/login\/\">Logige sisse<\/a><\/noindex>, palun.<\/p>\n<h2 class=\"default-block__polling-title\">Kas kasutate Netflow'i v\u00f5rgu j\u00e4lgimiseks?<\/h2>\n<ul class=\"content-list content-list_polling\">\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Jah<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ei, aga plaanin<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ei<\/p>\n<\/li>\n<\/ul>\n<p>    H\u00e4\u00e4letas 9 kasutajat. Eemale j\u00e4i 3 kasutajat.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/463625\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27883,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u00f5rgu j\u00e4lgimine ja anomaalse v\u00f5rgu tegevuse tuvastamine Flowmon Networks'i lahenduste abil | ProHoster","description":"Viimasel ajal leiab internetis hulgaliselt materjale v\u00f5rgu piiride liikluse anal\u00fc\u00fcsi teemal. Samas on k\u00f5ik kuidagi t\u00e4ielikult unustanud kohaliku liikluse anal\u00fc\u00fcsi, mis on samuti \u00fchtviisi oluline. K\u00e4esolev artikkel keskendubki just sellele teemale. Flowmon Networks'i n\u00e4itel tuletame meelde vanade head Netflow'i (ja selle alternatiivide), arutame huvitavaid juhtumeid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster","og:description":"\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b,","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:15+00:00","article:modified_time":"2019-10-31T19:16:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37189","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:32:13","updated":"2026-01-23 16:39:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37189"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27883"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}