{"id":37189,"date":"2019-10-31T22:16:15","date_gmt":"2019-10-31T19:16:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\/"},"modified":"2019-10-31T22:16:15","modified_gmt":"2019-10-31T19:16:15","slug":"setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","title":{"rendered":"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/8509341060b74259e9383af1b28c1e59.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen ultima vreme, pe Internet pot fi g\u0103site o mul\u021bime de materiale pe tema <b>analizei traficului la periferia re\u021belei<\/b>. Cu toate acestea, toat\u0103 lumea pare s\u0103 fi uitat complet de <b>analiza traficului local<\/b>, care este la fel de important. Aceast\u0103 articol se ocup\u0103 tocmai de acest subiect. Folosind exemplul <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/katalog\/flowmon\">Flowmon Networks<\/a><\/noindex> , ne vom aminti de vechiul \u0219i bunul Netflow (\u0219i alternativele sale), vom analiza cazuri interesante, posibile anomalii \u00een re\u021bea \u0219i vom \u00eenv\u0103\u021ba avantajele solu\u021biei, atunci c\u00e2nd <b>\u00eentreaga re\u021bea func\u021bioneaz\u0103 ca un singur senzor<\/b>. \u0218i cel mai important \u2014 un astfel de analiz\u0103 a traficului local poate fi realizat\u0103 complet gratuit, \u00een cadrul unei licen\u021be trial (<b>45 de zile<\/b>). Dac\u0103 acest subiect v\u0103 intereseaz\u0103, v\u0103 invit\u0103m mai departe. Dac\u0103 \u00eens\u0103 nu ave\u021bi chef s\u0103 citi\u021bi, atunci anticip\u00e2nd, pute\u021bi s\u0103 v\u0103 \u00eenregistra\u021bi la <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">webinarul viitor<\/a><\/noindex>, unde vom ar\u0103ta \u0219i explica totul (acolo se va putea afla \u0219i despre viitoarele cursuri de formare pentru produs).<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Ce este Flowmon Networks?<\/h3>\n<p>\n\u00cen primul r\u00e2nd, Flowmon este un furnizor IT european. Compania este ceh\u0103, cu sediul \u00een ora\u0219ul Brno (problema sanc\u021biunilor nu este discutat\u0103). \u00cen forma sa actual\u0103, compania este prezent\u0103 pe pia\u021b\u0103 din 2007. P\u00e2n\u0103 atunci, era cunoscut\u0103 sub marca Invea-Tech. A\u0219adar, \u00een total s-au investit aproape 20 de ani \u00een dezvoltarea produselor \u0219i solu\u021biilor.<\/p>\n<p>Flowmon este pozitionat ca un brand de clas\u0103 A. Dezvolt\u0103 solu\u021bii premium pentru clien\u021bi corporativi \u0219i este men\u021bionat \u00een rapoartele Gartner privind Monitorizarea Performan\u021bei \u0219i Diagnosticarea Re\u021belei (NPMD). Ceea ce este interesant este c\u0103, din toate companiile din raport, Flowmon este singurul furnizor men\u021bionat de Gartner ca produc\u0103tor de solu\u021bii at\u00e2t pentru monitorizarea re\u021belelor, c\u00e2t \u0219i pentru protec\u021bia informa\u021biilor (Analiza Comportamentului Re\u021belei). Nu ocup\u0103 \u00eenc\u0103 prima pozi\u021bie, dar tocmai din aceast\u0103 cauz\u0103 nu se compar\u0103 cu aripa unui Boeing.<\/p>\n<h3>Ce probleme permite produsul s\u0103 rezolve?<\/h3>\n<p>\n\u00cen linii mari, se pot sublinia urm\u0103toarele probleme rezolvate de produsele companiei:<\/p>\n<ol>\n<li>\u00eembun\u0103t\u0103\u021birea stabilit\u0103\u021bii func\u021bion\u0103rii re\u021belei \u0219i a resurselor de re\u021bea prin minimizarea timpului de nefunc\u021bionare \u0219i inaccesibilitate;<\/li>\n<li>cre\u0219terea nivelului general de performan\u021b\u0103 al re\u021belei;<\/li>\n<li>cre\u0219terea eficien\u021bei personalului administrativ, prin:\n<ul>\n<li>utilizarea instrumentelor moderne de monitorizare inovativ\u0103 a re\u021belei, bazate pe informa\u021bii despre fluxurile IP;<\/li>\n<li> furniz\u0103rii de analize detaliate privind func\u021bionarea \u0219i starea re\u021belei \u2013 utilizatorii \u0219i aplica\u021biile care activeaz\u0103 \u00een re\u021bea, datele transferate, resursele, serviciile \u0219i nodurile interac\u021bionante;<\/li>\n<li> r\u0103spunsului la incidente \u00eenainte ca acestea s\u0103 apar\u0103, nu dup\u0103 pierderea serviciului de c\u0103tre utilizatori \u0219i clien\u021bi;<\/li>\n<li> reducerii timpului \u0219i resurselor necesare pentru administrarea re\u021belei \u0219i a infrastructurii IT;<\/li>\n<li> simplific\u0103rii sarcinilor de identificare a defec\u021biunilor.<\/li>\n<\/ul>\n<\/li>\n<li>\u00eembun\u0103t\u0103\u021birii nivelului de securitate a re\u021belei \u0219i a resurselor informa\u021bionale ale \u00eentreprinderii, prin utilizarea tehnologiilor nesiguratizate pentru identificarea activit\u0103\u021bii re\u021belei anormale \u0219i d\u0103un\u0103toare, precum \u0219i a atacurilor de tip zero-day;<\/li>\n<li>asigur\u0103rii nivelului necesar de SLA pentru aplica\u021biile re\u021belistice \u0219i bazele de date.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Portofoliul de produse Flowmon Networks<\/h3>\n<p>\nAcum s\u0103 analiz\u0103m direct portofoliul de produse Flowmon Networks \u0219i s\u0103 afl\u0103m cu ce se ocup\u0103 concret compania. Dup\u0103 cum mul\u021bi \u0219i-au dat seama din nume, specializarea principal\u0103 este \u00een solu\u021bii pentru monitorizarea traficului flow, plus o serie de module suplimentare care extind func\u021bionalitatea de baz\u0103.<\/p>\n<p>De fapt, Flowmon poate fi considerat\u0103 o companie cu un singur produs, sau mai precis \u2013 o singur\u0103 solu\u021bie. S\u0103 vedem dac\u0103 e bine sau r\u0103u.<\/p>\n<p>Inima sistemului este colectorul, responsabil pentru colectarea datelor prin diverse protocoale flow, cum ar fi <b>NetFlow v5\/v9, jFlow, sFlow, NetStream, IPFIX<\/b>\u2026 Este destul de logic c\u0103 pentru o companie neafiliat\u0103 cu niciunul dintre produc\u0103torii de echipamente de re\u021bea \u2013 este important s\u0103 ofere o solu\u021bie universal\u0103, nu legat\u0103 de un singur standard sau protocol.<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/d8dddeaa90c8bc03b78282b7ca00ea86.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Collector<\/i><\/p>\n<p>Colectoarele sunt disponibile at\u00e2t sub form\u0103 de servere hardware, c\u00e2t \u0219i de ma\u0219ini virtuale (VMware, Hyper-V, KVM). Apropo, platforma hardware este realizat\u0103 pe servere DELL personalizate, ceea ce elimin\u0103 automat cea mai mare parte a problemelor legate de garan\u021bie \u0219i RMA. Componenta hardware proprie sunt, de fapt, pl\u0103cile FPGA pentru captarea traficului, dezvoltate de compania subsidiar\u0103 Flowmon, care permit monitorizarea la viteze de p\u00e2n\u0103 la 100 Gbps.<\/p>\n<p>Dar ce s\u0103 facem dac\u0103 echipamentele de re\u021bea existente nu pot genera flow de calitate? Sau dac\u0103 sarcina pe echipament este prea mare? Nicio problem\u0103:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/53dda0e4f42ddbf7a8add1064e0ab913.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Flowmon Prob<\/i><\/p>\n<p>\u00cen acest caz, Flowmon Networks ofer\u0103 utilizarea sondelor proprii (Flowmon Probe), care se conecteaz\u0103 la re\u021bea prin portul SPAN al switch-ului sau folosind divizoare pasive TAP.<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/298507c4bcb3d562f9621ff59ee6018f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Span (port de oglindire) \u0219i op\u021biuni TAP de implementare<\/i><\/p>\n<p>\u00cen acest caz, traficul \u201ebrut\u201d care ajunge la Flowmon Probe este transformat \u00een IPFIX extins, con\u021bin\u00e2nd mai mult de <b>240 de metrici cu informa\u021bii<\/b>. \u00cen timp ce protocolul standard NetFlow, generat de echipamentele de re\u021bea, con\u021bine nu mai mult de 80 de metrici. Aceasta permite vizibilitatea protocoalelor nu numai la nivelurile 3 \u0219i 4, ci \u0219i la nivelul 7 \u00een modelul ISO OSI. \u00cen cele din urm\u0103, administratorii de re\u021bea pot monitoriza func\u021bionarea aplica\u021biilor \u0219i protocoalelor precum e-mail, HTTP, DNS, SMB\u2026<\/p>\n<p>Conceptual, arhitectura logic\u0103 a sistemului arat\u0103 astfel:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/273517a6aa47726fe51c498114908c14.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPartea central\u0103 a \u00eentregii \u201eecosisteme\u201d Flowmon Networks este Collector-ul, care prime\u0219te traficul de pe echipamentele de re\u021bea existente sau de la sondele proprii (Probe). Dar pentru solu\u021bia Enterprise, a oferi func\u021bionalitate exclusiv pentru monitorizarea traficului de re\u021bea ar fi prea simplu. Acest lucru poate fi realizat \u0219i de solu\u021biile Open Source, chiar dac\u0103 nu cu aceea\u0219i performan\u021b\u0103. Valoarea Flowmon const\u0103 \u00een modulele suplimentare care extind func\u021bionalitatea de baz\u0103:<\/p>\n<ul>\n<li>modul <b>Detectare anomalii de securitate<\/b> \u2013 identificarea activit\u0103\u021bii anormale a re\u021belei, inclusiv atacuri \u201ezero-day\u201d, pe baza analizei heuristice a traficului \u0219i a profilului de re\u021bea tipic;<\/li>\n<li>modul <b>Monitorizarea performan\u021bei aplica\u021biilor<\/b> \u2013 controlul performan\u021bei aplica\u021biilor de re\u021bea f\u0103r\u0103 instalarea de \u201eagen\u021bi\u201d \u0219i f\u0103r\u0103 a afecta sistemele \u021bint\u0103;<\/li>\n<li>modul <b>Recorder de trafic<\/b> \u2013 \u00eenregistrarea fragmentelor de trafic de re\u021bea conform unui set de reguli prestabilite sau printr-un declan\u0219ator de la modul ADS, pentru o investigare ulterioar\u0103 \u0219i\/sau analiza incidentelor de securitate IT;<\/li>\n<li>modul <b>Protec\u021bie DDoS<\/b> \u2013 protec\u021bia perimetrului re\u021belei \u00eempotriva atacurilor volumetrice de tip DoS\/DDoS, inclusiv atacurilor asupra aplica\u021biilor (OSI L3\/L4\/L7).<\/li>\n<\/ul>\n<p>\n\u00cen aceast\u0103 articole, vom analiza cum func\u021bioneaz\u0103 totul \u00een live, folosind ca exemplu 2 module \u2013 <b>Monitorizarea \u0219i diagnosticarea performan\u021bei re\u021belei<\/b> \u0219i <b>Detectare anomalii de securitate<\/b>.<br \/>\nDatele ini\u021biale:<\/p>\n<ul>\n<li>server Lenovo RS 140 cu hipervizor VMware 6.0;<\/li>\n<li>imaginea ma\u0219inii virtuale Flowmon Collector, care poate fi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.flowmon.com\/en\/download-free-trial\">desc\u0103rcat aici<\/a><\/noindex>;<\/li>\n<li>o pereche de switch-uri care suport\u0103 protocoalele de flow.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Pasul 1. Instalarea Flowmon Collector<\/h3>\n<p>\nDesf\u0103\u0219urarea unei ma\u0219ini virtuale pe VMware se realizeaz\u0103 \u00eentr-un mod complet standard dintr-un \u0219ablon OVF. \u00cen final, ob\u021binem o ma\u0219in\u0103 virtual\u0103 care ruleaz\u0103 CentOS \u0219i cu software-ul gata de utilizare. Cerin\u021bele de resurse sunt umane:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/9ae1559b01c639763e0053ee1de120ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nR\u0103m\u00e2ne doar s\u0103 efectu\u0103m ini\u021bializarea de baz\u0103 cu comanda <b>sysconfig<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/c65a47dfd025595f7256b1e30b941e42.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nConfigur\u0103m IP-ul pe portul de management, DNS-ul, ora, hostname-ul \u0219i putem s\u0103 ne conect\u0103m la interfa\u021ba WEB.<\/p>\n<h3>Pasul 2. Instalarea licen\u021bei<\/h3>\n<p>\nLicen\u021ba de prob\u0103 pentru o lun\u0103 \u0219i jum\u0103tate este generat\u0103 \u0219i desc\u0103rcat\u0103 \u00eempreun\u0103 cu imaginea ma\u0219inii virtuale. Se \u00eencarc\u0103 prin <b>Configuration Center -&gt; License<\/b>. \u00cen final, vedem:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/a5c1c99ad14cf4ca5dfb560d55fa369d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTotul este preg\u0103tit. Putem \u00eencepe lucrul.<\/p>\n<h3>Pasul 3. Configurarea receptorului pe colector<\/h3>\n<p>\n\u00cen aceast\u0103 etap\u0103, trebuie s\u0103 stabilim cum vor fi primite datele din surse \u00een sistem. A\u0219a cum am men\u021bionat anterior, aceasta poate fi unul dintre protocoalele flow sau un port SPAN pe switch.<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/3ff1c77a58c152314a1615dd98ca92ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen exemplul nostru, vom folosi primirea datelor prin protocoalele <b>NetFlow v9 \u0219i IPFIX<\/b>. \u00cen acest caz, ca \u021bint\u0103, indic\u0103m adresa IP a interfe\u021bei de management \u2013 <b>192.168.78.198<\/b>. Interfe\u021bele eth2 \u0219i eth3 (cu tipul de interfa\u021b\u0103 de monitorizare) sunt utilizate pentru a primi o copie a traficului \u201eraw\u201d de pe portul SPAN al switch-ului. Le ignor\u0103m, nu este cazul nostru.<br \/>\nApoi verific\u0103m portul colectorului, unde ar trebui s\u0103 ajung\u0103 traficul.<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/31fff2f3bfef52b001edb39bdb3293f9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen cazul nostru, colectorul a\u0219teapt\u0103 traficul pe portul UDP\/2055.<\/p>\n<h3>Pasul 4. Configurarea echipamentului de re\u021bea pentru exportul flow<\/h3>\n<p>\nConfigurarea NetFlow pe echipamentele Cisco Systems poate fi numit\u0103 o activitate complet obi\u0219nuit\u0103 pentru orice administrator de re\u021bea. Pentru exemplul nostru, vom lua ceva mai neobi\u0219nuit. De exemplu, routerul MikroTik RB2011UiAS-2HnD. Da, la fel de ciudat cum pare, aceast\u0103 solu\u021bie bugetar\u0103 pentru birouri mici \u0219i de acas\u0103 sus\u021bine de asemenea protocoalele NetFlow v5\/v9 \u0219i IPFIX. \u00cen set\u0103ri, definim \u021binta (adresa colectorului 192.168.78.198 \u0219i portul 2055):<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/3604b4c1c0b013a3822e99d97ab9e9cb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0218i ad\u0103ug\u0103m toate metricele disponibile pentru export:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/f22fa921b4195b184e82c12a2b852f3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPe aceasta putem afirma c\u0103 setarea de baz\u0103 este complet\u0103. Verific\u0103m dac\u0103 traficul ajunge \u00een sistem.<\/p>\n<h3>Pasul 5. Verificarea \u0219i exploatarea modulului de Monitorizare \u0219i Diagnosticare a Performan\u021bei Re\u021belei<\/h3>\n<p>\nPutem verifica existen\u021ba traficului de la surs\u0103 \u00een sec\u021biunea <b>Flowmon Monitoring Center -&gt; Sources<\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/b167ac4ba70c07d9d0fb521a1cf1a7ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVedem c\u0103 datele ajung \u00een sistem. Dup\u0103 un timp, odat\u0103 ce colectorul a acumulat trafic, widget-urile vor \u00eencepe s\u0103 afi\u0219eze informa\u021biile:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/8cee4912c371366ff30ff7597f87cabc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSistemul este construit pe principiul drill down. Asta \u00eenseamn\u0103 c\u0103 utilizatorul, aleg\u00e2nd un fragment de interes pe diagram\u0103 sau grafic, \u201ecoboar\u0103\u201d la nivelul de ad\u00e2ncime a datelor de care are nevoie:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/1caa3b3c59dcd77210f690606a16740f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e2n\u0103 la informa\u021biile despre fiecare conexiune de re\u021bea \u0219i conectare:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/ef8c8f4d2df0ae65b94fcc3be058099b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Pasul 6. Modulul Anomaly Detection Security<\/h3>\n<p>\nAcest modul poate fi considerat, poate, unul dintre cele mai interesante, datorit\u0103 utiliz\u0103rii metodelor de detectare a anomaliilor f\u0103r\u0103 semn\u0103turi \u00een traficul de re\u021bea \u0219i activitatea d\u0103un\u0103toare pe re\u021bea. Dar acesta nu este un sistem IDS\/IPS. Lucrul cu modulul \u00eencepe cu \u201e\u00eenv\u0103\u021barea\u201d acestuia. \u00cen acest scop, \u00eentr-un wizard special, sunt specificate toate componentele \u0219i serviciile cheie ale re\u021belei, inclusiv:<\/p>\n<ul>\n<li>adresele gateway-ului, serverelor DNS, DHCP \u0219i NTP,<\/li>\n<li>adressarea \u00een segmentele utilizatorilor \u0219i serverelor.<\/li>\n<\/ul>\n<p>\nDup\u0103 aceasta, sistemul trece \u00een modul de \u00eenv\u0103\u021bare, care dureaz\u0103 \u00een medie \u00eentre 2 s\u0103pt\u0103m\u00e2ni \u0219i 1 lun\u0103. \u00cen aceast\u0103 perioad\u0103, sistemul formeaz\u0103 un baseline al traficului specific re\u021belei noastre. Cu alte cuvinte, sistemul studiaz\u0103:<\/p>\n<ul>\n<li>ce comportament este caracteristic pentru nodurile re\u021belei?<\/li>\n<li>ce volume de date sunt de obicei transmise \u0219i sunt normale pentru re\u021bea?<\/li>\n<li>ce timp de activitate este tipic pentru utilizatori?<\/li>\n<li>ce aplica\u021bii func\u021bioneaz\u0103 \u00een re\u021bea?<\/li>\n<li>\u0219i multe altele..<\/li>\n<\/ul>\n<p>\n\u00cen cele din urm\u0103, ob\u021binem un instrument care identific\u0103 orice anomalii \u00een re\u021beaua noastr\u0103 \u0219i abateri de la comportamentul caracteristic. Iat\u0103 c\u00e2teva exemple pe care sistemul le poate detecta:<\/p>\n<ul>\n<li>r\u0103sp\u00e2ndirea \u00een re\u021bea a unui nou malware, nedetectabil de semn\u0103turile antivirus;<\/li>\n<li>construirea de tuneluri DNS, ICMP sau alte tuneluri \u0219i transferul de date ocolind firewall-ul;<\/li>\n<li>apari\u021bia \u00een re\u021bea a unui nou computer care se d\u0103 drept server DHCP \u0219i\/sau DNS.<\/li>\n<\/ul>\n<p>\nS\u0103 vedem cum arat\u0103 acest lucru \u00een practic\u0103. Dup\u0103 ce sistemul dumneavoastr\u0103 a trecut prin procesul de \u00eenv\u0103\u021bare \u0219i a construit baseline-ul traficului de re\u021bea, \u00eencepe s\u0103 detecteze incidente:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/e4d7d168716fc9f703dd9f14faf5816f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPagina principal\u0103 a modulului \u2013 un grafic temporal care arat\u0103 incidentele detectate. \u00cen exemplul nostru vedem o cre\u0219tere evident\u0103, aproximativ \u00eentre orele 9 \u0219i 16. O selec\u021bion\u0103m \u0219i analiz\u0103m mai \u00een detaliu. <\/p>\n<p>Se remarc\u0103 comportamentul anormal al atacatorului \u00een re\u021bea. Totul \u00eencepe cu faptul c\u0103 un host cu adresa 192.168.3.225 a \u00eenceput s\u0103 scaneze orizontal re\u021beaua pe portul 3389 (serviciul Microsoft RDP) \u0219i g\u0103se\u0219te 14 \u201evictime\u201d poten\u021biale:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/5844fab428bd7adedbc694bf7dc7f19e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0219i<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/566cb37c28eb803d404e06a8d61372c3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUrm\u0103torul incident \u00eenregistrat \u2013 hostul 192.168.3.225 \u00eencepe un atac de tip brute-force pentru ghicirea parolelor pe serviciul RDP (port 3389) pe adresele identificate anterior:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/18c97646b3982c5a9db86901cae9f5a7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCa urmare a atacului pe unul dintre hosturile compromise se \u00eenregistreaz\u0103 o anomalie SMTP. Cu alte cuvinte, a \u00eenceput trimiterea de SPAM:<\/p>\n<p><img decoding=\"async\" alt=\"Monitorizarea re\u021belei \u0219i identificarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks\" src=\"\/wp-content\/uploads\/2019\/08\/fd1fce3c9bb23903a3c54d270924c5fe.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAcest exemplu este o demonstra\u021bie clar\u0103 a capacit\u0103\u021bilor sistemului \u0219i modulului Anomaly Detection Security, \u00een special. Judeca\u021bi pentru eficien\u021ba sa. Cu aceasta, \u00eencheiem review-ul func\u021bional al solu\u021biei.<\/p>\n<h3>Concluzie<\/h3>\n<p>\nS\u0103 rezum\u0103m ce concluzii putem trasa despre Flowmon \u00een final:<\/p>\n<ul>\n<li>Flowmon \u2013 o solu\u021bie de nivel premium pentru clien\u021bii corporativi;<\/li>\n<li>datorit\u0103 versatilit\u0103\u021bii \u0219i compatibilit\u0103\u021bii, colectarea datelor este disponibil\u0103 din orice surs\u0103: echipamente de re\u021bea (Cisco, Juniper, HPE, Huawei\u2026) sau sonde proprii (Flowmon Probe);<\/li>\n<li>posibilit\u0103\u021bile de scalabilitate ale solu\u021biei permit extinderea func\u021bionalit\u0103\u021bii sistemului prin ad\u0103ugarea de module noi, precum \u0219i cre\u0219terea performan\u021bei datorit\u0103 abord\u0103rii flexibile la licen\u021biere;<\/li>\n<li>datorit\u0103 utiliz\u0103rii tehnologiilor de analiz\u0103 f\u0103r\u0103 semn\u0103tur\u0103, sistemul permite detectarea chiar \u0219i a atacurilor zero-day necunoscute antiviruselor \u0219i sistemelor IDS\/IPS;<\/li>\n<li>datorit\u0103 \u201etransparen\u021bei\u201d complete din punct de vedere al instal\u0103rii \u0219i prezen\u021bei sistemului \u00een re\u021bea \u2013 solu\u021bia nu afecteaz\u0103 func\u021bionarea altor noduri \u0219i componente ale infrastructurii IT;<\/li>\n<li>Flowmon \u2013 singura solu\u021bie de pe pia\u021b\u0103 care suport\u0103 monitorizarea traficului la viteze de p\u00e2n\u0103 la 100 Gbit\/s;<\/li>\n<li>Flowmon \u2013 o solu\u021bie pentru re\u021bele de orice dimensiune;<\/li>\n<li>cel mai bun raport pre\u021b \/ func\u021bionalitate dintre solu\u021biile similare.<\/li>\n<\/ul>\n<p>\n\u00cen acest review am acoperit mai pu\u021bin de 10% din func\u021bionalitatea general\u0103 a solu\u021biei. \u00cen urm\u0103torul articol vom vorbi despre celelalte module Flowmon Networks. Folosind modulul Application Performance Monitoring vom ar\u0103ta cum administratorii aplica\u021biilor de business pot asigura disponibilitatea la nivelul dorit SLA, precum \u0219i diagnostica rapid problemele.<\/p>\n<p>De asemenea, dorim s\u0103 v\u0103 invit\u0103m la webinarul nostru (10.09.2019), dedicat solu\u021biilor vendorului Flowmon Networks. Pentru \u00eenregistrare preliminar\u0103, v\u0103 rug\u0103m <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/events\/vebinari_flowmon\">s\u0103 v\u0103 \u00eenregistra\u021bi aici<\/a><\/noindex>.<br \/>\nAsta e tot pentru acum, mul\u021bumim pentru interesul dumneavoastr\u0103!<\/p>\n<p class=\"for_users_only_msg\">Numai utilizatorii \u00eenregistra\u021bi pot participa la sondaj. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/auth\/login\/\">Conecta\u021bi-v\u0103<\/a><\/noindex>, v\u0103 rug\u0103m.<\/p>\n<h2 class=\"default-block__polling-title\">Folosi\u021bi Netflow pentru monitorizarea re\u021belei?<\/h2>\n<ul class=\"content-list content-list_polling\">\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Da<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Nu, dar pl\u0103nuiesc<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Nu<\/p>\n<\/li>\n<\/ul>\n<p>    Au votat 9 utilizatori. 3 utilizatori s-au ab\u021binut.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/463625\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b-\u0432\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432 \u043f\u043e \u0442\u0435\u043c\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u0441\u0435\u0442\u0438. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0432\u0441\u0435 \u043f\u043e\u0447\u0435\u043c\u0443-\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0437\u0430\u0431\u044b\u043b\u0438 \u043e\u0431 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u043c. \u0414\u0430\u043d\u043d\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043a\u0430\u043a \u0440\u0430\u0437 \u0438 \u043f\u043e\u0441\u0435\u0449\u0435\u043d\u0430 \u044d\u0442\u043e\u0439 \u0442\u0435\u043c\u0435. \u041d\u0430 \u043f\u0440\u0438\u043c\u0435\u0440\u0435 Flowmon Networks \u043c\u044b \u0432\u0441\u043f\u043e\u043c\u043d\u0438\u043c \u0441\u0442\u0430\u0440\u044b\u0439 \u0434\u043e\u0431\u0440\u044b\u0439 Netflow (\u0438 \u0435\u0433\u043e \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u044b), \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u043a\u0435\u0439\u0441\u044b, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27883,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Monitorizarea re\u021belei \u0219i detectarea activit\u0103\u021bii anormale \u00een re\u021bea cu ajutorul solu\u021biilor Flowmon Networks | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0440\u0435\u0448\u0435\u043d\u0438\u0439 Flowmon Networks | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/setevoj-monitoring-i-vyyavleniya-anomalnoj-setevoj-aktivnosti-s-pomoshhyu-reshenij-flowmon-networks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:15+00:00","article:modified_time":"2019-10-31T19:16:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37189","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:32:13","updated":"2026-01-23 16:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37189"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37189\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/27883"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}