Ebipụtala ntọhapụ nke Netflow / IPFIX onye na-anakọta Xenoeye 23.11, nke na-enye gị ohere ịnakọta ọnụ ọgụgụ na ọnụọgụ okporo ụzọ site na ngwaọrụ netwọk dị iche iche, na-ebufe site na iji usoro Netflow v5, v9 na IPFIX, yana nhazi data, ịmepụta akụkọ na ịmepụta eserese. Edere isi ọrụ ahụ na C, a na-ekesa koodu n'okpuru ikikere ISC.
Onye nnakọta ahụ na-achịkọta okporo ụzọ netwọkụ site na mpaghara ahọpụtara wee bupu data na PostgreSQL. Iji data a, ị nwere ike wulite akụkọ, eserese (iji gnuplot, Python + Matplotlib scripts) ma ọ bụ dashboards na Grafana. Na mgbakwunye, onye na-anakọta nwere ike ịme script omenala mgbe agafere oke. A na-eji nkezi na-akpụ akpụ iji gbakọọ ọsọ okporo ụzọ. Onye na-anakọta na-abịa na ihe atụ nke script Robot Telegram nke nwere ike ịgwa onye ozi gbasara ịgba ọsọ karịa ụfọdụ ọnụ ụzọ.
Mgbanwe na ụdị ọhụrụ:
- Agbakwunyere ike iji GeoIP site na iji ọdụ data ipapi. Iji ọrụ GeoIP, ị nwere ike ịmepụta ihe nleba anya geo (dịka ọmụmaatụ, kenye naanị okporo ụzọ Russia ka ọ bụrụ ihe nleba anya dị iche) na data mbupụ nke GeoIP mebiri. Onye nchịkọta na-akwado granularity site na obodo, mpaghara na obodo. Na mgbakwunye, ị nwere ike nweta longitude na latitude site na adreesị IP (n'agbanyeghị na ịkwesịrị ịghọta na ihe a niile na-arụ ọrụ nke ọma).
- Maka ndị na-anya ụgbọ njem na-enweghị ike mbupụ nọmba sistemụ kwụụrụ onwe na Netflow/IPFIX, ọ ga-ekwe omume ịnweta nọmba ndị a na nkọwa ederede ha site na iji ọdụ data ip-location-db. Dịka maka GeoIP, ị nwere ike ịmepụta ihe nleba anya dị iche, nke gụnyere okporo ụzọ AS ahọpụtara, ma ọ bụ bupu aha sistemụ kwụụrụ onwe ya na DBMS.
- Nhazi okporo ụzọ agbakwunyere site na mpaghara netflow. Onye na-anakọta ihe nwere ike were ụfọdụ mpaghara kewaa ihe nleba anya (ọkọlọtọ TCP, ọdụ ụgbọ mmiri, nha ngwugwu)
- Agbakwunyela ihe njikwa njikwa xegeoq, nke na-enye gị ohere ịnweta ozi GeoIP yana ozi AS site na adreesị IP site na iji ọdụ data mpaghara.
isi: opennet.ru