Moqokeleli oa Xenoeye Netflow o fumaneha, e leng se u lumellang hore u bokelle lipalo-palo mabapi le phallo ea sephethephethe ho tloha lisebelisoa tse sa tšoaneng tsa marang-rang, tse fetisetsoang ho sebelisa li-protocol tsa Netflow v9 le IPFIX, ho sebetsana le data, ho hlahisa litlaleho le ho haha li-graph. Ho phaella moo, 'mokelli a ka tsamaisa mangolo a tloaelehileng ha menyako e feta. Moko oa morero o ngotsoe ka C, khoutu e ajoa tlas'a laesense ea ISC.
Likarolo tsa Collector:
- Lintlha tse kopantsoeng ke likarolo tse hlokahalang tsa Netflow li romelloa ho PostgreSQL. Ho kopanya pele ho etsahala ka har'a letamo.
- Ka ntle ho lebokose, ho tšehetsoa feela sete ea mantlha ea masimo a Netflow, empa o ka eketsa hoo e ka bang tšimo efe kapa efe.
- Ts'ebetso ea 'mokelli, ho itšetlehile ka mofuta oa sephethephethe le litlaleho, e ka fihla "phallo e phallang ka motsotsoana" e likete tse makholo a 'maloa ho CPU e le' ngoe. Mokhoa oa kabo ea mojaro ke sesebelisoa (router) ka phallo.
- 'Mokelli o sebelisa lipalo tse tsamaeang ho bala lebelo la sephethephethe.
- Mopokelli a ka sebelisoa ho batla mabotho a tšoaelitsoeng (ho romela spam ea imeile, HTTP(S) -flood, SSH scanners), ho lemoha ho phatloha ka tšohanyetso nakong ea tlhaselo ea DoS/DDoS.
- Litlaleho tsa marang-rang li ka bonoa ho sebelisoa lits'ebeletso tse fapaneng: gnuplot, Python scripts + Matplotlib, ho sebelisoa Grafana.
- Ho fapana le babokelli ba bangata ba mehleng ea kajeno, morero ha o sebelise Apache Kafka, Elastic, joalo-joalo, lipalo tse ka sehloohong li etsahala ka hare ho mokelli ka boeena.
Source: opennet.ru