Ho lokolloa ha moqokeleli oa Netflow/IPFIX/sFlow Xenoeye 25.02 e phatlalalitsoe. Moqokeleli o u lumella ho bokella lipalo-palo mabapi le phallo ea sephethephethe ho tsoa ho lisebelisoa tse fapaneng tsa marang-rang, tse fetisitsoeng ho sebelisoa Netflow v5, v9, IPFIX le sFlow protocols, data process, hlahisa litlaleho le ho haha li-graph. Moko oa morero o ngotsoe ka C, khoutu e ajoa tlas'a laesense ea ISC.
'Mokelli o kopanya sephethephethe sa marang-rang ka likarolo tse khethiloeng le ho romela data ho PostgreSQL. Ho latela lintlha tsena, u ka haha litlaleho, li-graph (ho sebelisa gnuplot, Python scripts + Matplotlib) kapa li-dashboard ho Grafana. Ho phaella moo, 'mokelli a ka tsamaisa mangolo a tloaelehileng ha menyako e fetisitsoe kapa ha sephethephethe se oela ka tlas'a menyako.
Lipalo-palo tse tsamaeang li sebelisoa ho bala lebelo la hajoale la sephethephethe. Mochini o hlokomelang ho fetella ha moeli o etselitsoe ho tsebisa ka litlhaselo tsa DoS/DDoS le ho qala khatello ka liphatlalatso tsa BGP (Flowspec kapa Blackhole). 'Mokelli o tla le mohlala oa mongolo oa roboto oa Telegram o ka tsebisang lenģosa ka lintho tse sa tloaelehang. Moqokeleli ha a hloke lisebelisoa, a ka sebetsana le sephethephethe sa marang-rang a manyane ho Raspberry / Orange Pi kapa mochining o nang le 2-4 GB ea RAM.
Liphetoho phetolelong e ncha:
- Tšehetso bakeng sa protocol ea sFlow e ekelitsoe, e nolofalletsang ho sekaseka lipakete tsa marang-rang le ho ntša tlhahisoleseling ea DNS le TLS (HTTPS) SNI. Beng ba lits'ebeletso tsa data le beng ba litsi tsa data ba ka sebelisa tšobotsi ena ho loantša phishing le ho lekola hore na ke efe libaka 'me libaka tsa marang-rang li bolokiloe marang-rang.
- Ts'ehetso e ekelitsoeng bakeng sa lintho tse behang leihlo / tsa maemo a phahameng, e lumellang ho nolofatsa litlhophiso tse ling ka palo e kholo ea lintho le ho ntlafatsa ts'ebetso ea ts'ebetso ha e bapisoa le lenane le "flat" la lintho tse behang leihlo.
- E ekelitse bokhoni ba ho khetholla li-interfaces - sephethephethe se tsoang ho li-interfaces tse khethiloeng tsa marang-rang tsa li-routers kapa li-switches li ka hlokomolohuoa kapa tsa sebetsoa ka tsela e khethehileng.
- Ho ekelitsoe bokhoni ba ho beha leihlo eseng feela ho phahama ha sephethephethe, empa hape le ho theoha ka tlase ho meeli, e leng se ka bang molemo bakeng sa ho beha leihlo ka tsela e sa tobang motho ka mong lisebelisoa kapa litšebeletso.
- E ekelitse bokhoni ba ho fetola menyako ea sephethephethe ntle le ho qala mokelli hape. Mochini o etselitsoe boemo boo basebelisi ba ipallang menyako ba ipapisitse le lipalo-palo tsa linako tse fetileng le ho ntlafatsa nako le nako ho mokelli.
- E kentse setshelo sa LXC bakeng sa ho tsamaisoa ka potlako le liteko tsa mokelli. Sets'oants'o se kenyelletsa mokelli ea nang le lintho tsa ho beha leihlo tse kentsoeng pele, PostgreSQL le Grafana.
Source: opennet.ru
