Ho lokolloa ha moqokeleli oa Netflow / IPFIX Xenoeye 23.11 e hatisitsoe, e leng se u lumellang hore u bokelle lipalo-palo tsa phallo ea sephethephethe ho tloha lisebelisoa tse sa tšoaneng tsa marang-rang, tse fetisetsoang ho sebelisa li-protocol tsa Netflow v5, v9 le IPFIX, hammoho le data ea ts'ebetso, ho hlahisa litlaleho le ho haha li-graph. Moko oa morero o ngotsoe ka C, khoutu e ajoa tlas'a laesense ea ISC.
'Mokelli o kopanya sephethephethe sa marang-rang ka likarolo tse khethiloeng ebe o romela data ho PostgreSQL. U sebelisa lintlha tsena, u ka haha litlaleho, li-graph (ho sebelisa gnuplot, Python + Matplotlib scripts) kapa li-dashboards Grafana. Ho phaella moo, 'mokelli a ka tsamaisa mangolo a tloaelehileng ha menyako e feta. Lipalo-palo tse tsamaeang li sebelisoa ho bala lebelo la sephethephethe. 'Mokelli o tla le mohlala oa mongolo oa roboto oa Telegram o ka tsebisang lenģosa ka ho potlaka ka holimo ho menyako e itseng.
Liphetoho phetolelong e ncha:
- E kentse bokhoni ba ho sebelisa GeoIP ho sebelisa ipapi databases. U sebelisa mesebetsi ea GeoIP, u ka etsa lintho tsa geo-monitoring (mohlala, ho abela sephethephethe feela ho ea Russia ho ntho e 'ngoe ea ho beha leihlo) le ho romela lintlha tse romelloang ke GeoIP. 'Mokelli o tšehetsa granularity ho ea ka naha, sebaka le toropo. Ntle le moo, o ka fumana longitude le latitude ho tsoa atereseng ea IP (leha o hloka ho utloisisa hore sena sohle se sebetsa haholo).
- Bakeng sa li-routers tse sa khoneng ho romela linomoro tsa tsamaiso e ikemetseng ho Netflow/IPFIX, hoa khoneha ho fumana linomoro tsena le tlhaloso ea tsona ea mongolo ho sebelisa li-database tsa ip-location-db. Joalo ka GeoIP, o ka etsa lintho tse ka thoko tsa ho beha leihlo, tse kenyelletsang sephethephethe sa li-AS tse khethiloeng, kapa oa romella mabitso a litsamaiso tse ikemetseng ho DBMS.
- Phapang ea sephethephethe e ekelitsoeng ka libaka tsa netflow. Mokelli a ka hlophisa lintho tsa ho beha leihlo a sebelisa masimo a mang (lifolakha tsa TCP, likou, boholo ba lipakete)
- Ts'ebeliso ea xegeoq console e kentsoe, e u lumellang ho fumana tlhaiso-leseling ea GeoIP le tlhaiso-leseling ea AS ho tsoa ho liaterese tsa IP u sebelisa li-database tsa lehae.
Source: opennet.ru