Kutshanje, unokufumana isixa esikhulu semathiriyeli kwisihloko kwi-Intanethi. uhlalutyo lwetrafikhi kwi-perimeter yenethiwekhi. Ngelo xesha, ngesizathu esithile wonke umntu walibala ngokupheleleyo uhlalutyo lwetrafikhi yendawo, engabalulekanga kangako. Eli nqaku lichaza ngqo esi sihloko. Umzekelo siya kukhumbula i-Netflow endala (kunye nezinye iindlela zayo), jonga iimeko ezinomdla, ii-anomalies ezinokwenzeka kwinethiwekhi kwaye ufumanise iingenelo zesisombululo xa Iyonke inethiwekhi isebenza njengoluvo olunye. Kwaye okona kubaluleke kakhulu, unokwenza uhlalutyo olunjalo lwetrafikhi yasekhaya simahla, ngaphakathi kwesakhelo selayisensi yovavanyo (Iintsuku ze-45). Ukuba isihloko sinomdla kuwe, wamkelekile kwikati. Ukuba uvila kakhulu ukufunda, ngoko, ujonge phambili, unokubhalisa , apho siya kubonisa kwaye sikuxelele yonke into (unokufunda malunga noqeqesho oluzayo lwemveliso apho).
Yintoni i-Flowmon Networks?
Okokuqala, i-Flowmon ngumthengisi we-IT waseYurophu. Inkampani yiCzech, enekomkhulu eBrno (umcimbi wezohlwayo awuzange uphakanyiswe). Kwimo yayo yangoku, inkampani ikwimarike ukusukela ngo-2007. Ngaphambili, ibisaziwa phantsi kohlobo lwe-Invea-Tech. Ke, iyonke, phantse iminyaka engama-20 yachithwa ekuphuhliseni iimveliso kunye nezisombululo.
I-Flowmon ibekwe njengophawu lwe-A-class. Ukuphuhlisa izisombululo ze-premium kubathengi bezoshishino kwaye ziphawulwe kwiikwere ze-Gartner kwi-Network Performance Monitoring and Diagnostics (NPMD) indawo. Ngaphezu koko, okuthakazelisayo, kuzo zonke iinkampani ezikwingxelo, u-Flowmon nguye kuphela umthengisi oqatshelwe nguGartner njengomvelisi wezisombululo zombini ukujongwa kwenethiwekhi kunye nokukhuselwa kolwazi (Uhlalutyo lwe-Network Behavior). Ayithathi indawo yokuqala okwangoku, kodwa ngenxa yoku ayimi njengephiko leBoeing.
Zeziphi iingxaki ezisonjululwa yimveliso?
Ehlabathini lonke, sinokwahlula le misebenzi ilandelayo isonjululwe ziimveliso zenkampani:
- ukwandisa ukuzinza kwenethiwekhi, kunye nezibonelelo zenethiwekhi, ngokunciphisa ixesha labo lokuphumla kunye nokungafumaneki;
- ukwandisa inqanaba elipheleleyo lomsebenzi womnatha;
- ukwandisa ukusebenza kakuhle kwabasebenzi bolawulo ngenxa:
- usebenzisa izixhobo zanamhlanje zokubeka iliso zenethiwekhi ezisekelwe kulwazi malunga nokuhamba kwe-IP;
- ukubonelela nge-analytics eneenkcukacha malunga nokusebenza kunye nesimo sothungelwano - abasebenzisi kunye nezicelo ezisebenza kwinethiwekhi, idatha edlulisiweyo, izibonelelo ezisebenzisanayo, iinkonzo kunye node;
- ukuphendula kwiziganeko ngaphambi kokuba zenzeke, kwaye kungekhona emva kokuba abasebenzisi kunye nabathengi balahlekelwe yinkonzo;
- ukunciphisa ixesha kunye nezibonelelo ezifunekayo ukulawula uthungelwano kunye neziseko ze-IT;
- ukwenza lula imisebenzi yokusombulula ingxaki.
- ukwandisa inqanaba lokhuseleko lothungelwano kunye nemithombo yolwazi yeshishini, ngokusetyenziswa kwetekhnoloji engasayiniyo yokubona umsebenzi womnatha ongalunganga kunye nolunya, kunye "nohlaselo lweentsuku zero";
- ukuqinisekisa inqanaba elifunekayo le-SLA kwizicelo zenethiwekhi kunye nogcino-lwazi.
I-Flowmon Networks Product Portfolio
Ngoku makhe sijonge ngqo kwipotifoliyo yemveliso yeFlowmon Networks kwaye sifumanise ukuba yintoni kanye le yenziwa yinkampani. Njengoko abaninzi sele beqikelele kwigama, eyona nto iphambili ikwizisombululo zokuhambisa iliso lokuhamba kwetrafikhi, kunye nenani leemodyuli ezongezelelweyo ezandisa ukusebenza okusisiseko.
Enyanisweni, i-Flowmon inokubizwa ngokuba yinkampani yemveliso enye, okanye kunoko, isisombululo esinye. Makhe sibone ukuba oku kulungile okanye kubi.
Undoqo wenkqubo ngumqokeleli, onoxanduva lokuqokelela idatha usebenzisa iiprothokholi zokuhamba ezahlukeneyo, ezifana NetFlow v5/v9, jFlow, sFlow, NetStream, IPFIX... Kusengqiqweni ukuba kwinkampani enganxulumananga naye nawuphi na umenzi wesixhobo sothungelwano, kubalulekile ukunika imarike imveliso yehlabathi jikelele engabotshelelwanga kumgangatho omnye okanye iprotocol.
Umqokeleli we-Flowmon
Umqokeleli ufumaneka zombini njengomncedisi we-hardware kunye nomatshini obonakalayo (VMware, Hyper-V, KVM). Ngendlela, i-platform ye-hardware iphunyezwa kwiiseva ze-DELL ezenziwe ngokwezifiso, eziphelisa ngokuzenzekelayo ininzi yemiba ngewaranti kunye ne-RMA. Ekuphela kwezixhobo ze-hardware zobunikazi ngamakhadi e-FPGA wokubamba i-traffic aphuhliswe yi-subsidiary ye-Flowmon, evumela ukubeka iliso kwisantya ukuya kwi-100 Gbps.
Kodwa yintoni onokuyenza ukuba izixhobo zenethiwekhi ezikhoyo azikwazi ukuvelisa ukuhamba okusemgangathweni ophezulu? Okanye ngaba umthwalo kwisixhobo uphezulu kakhulu? Akhongxaki:
Flowmon Prob
Kulo mzekelo, iiNethiwekhi ze-Flowmon zinikezela ukusebenzisa i-probes zayo (i-Flowmon Probe), edityaniswe kumsebenzi wothungelwano nge-SPAN port yokutshintsha okanye usebenzisa i-TAP yokwahlulahlula.
I-SPAN (isibuko sesibuko) kunye neenketho zokuphunyezwa kwe-TAP
Kulo mzekelo, itrafikhi ekrwada efika kwi-Flowmon Probe iguqulwa ibe yi-IPFIX eyandisiweyo equlathe ngaphezulu. Ngama-240 eemitha ezinolwazi. Ngelixa i-protocol ye-NetFlow eqhelekileyo eveliswa sisixhobo sothungelwano ayinayo ngaphezu kwee-metrics ezingama-80. Oku kuvumela ukubonakala kweprotocol kungekhona kuphela kumanqanaba 3 kunye ne-4, kodwa nakwinqanaba lesi-7 ngokwemodeli ye-ISO OSI. Ngenxa yoko, abalawuli benethiwekhi banokubeka iliso ekusebenzeni kwezicelo kunye neeprothokholi ezifana ne-imeyile, i-HTTP, i-DNS, i-SMB...
Ngokwengqiqo, uyilo olunengqiqo lwenkqubo lukhangeleka ngolu hlobo:
Inxalenye ephakathi kuyo yonke i-Flowmon Networks "i-ecosystem" yi-Collector, efumana i-traffic kwizixhobo zenethiwekhi ezikhoyo okanye iiprobes zayo (iProbe). Kodwa kwisisombululo seShishini, ukubonelela ngokusebenza kuphela ukujonga itrafikhi yenethiwekhi kuya kuba lula kakhulu. Izisombululo zoMthombo oVulekileyo zinokwenza oku, nangona kungekuko ukusebenza okunjalo. Ixabiso le-Flowmon ziimodyuli ezongezelelweyo ezandisa umsebenzi osisiseko:
- imodyuli Ukhuseleko lokuFumana okungaqhelekanga - ukuchongwa komsebenzi womnatha ongaqhelekanga, kubandakanywa nokuhlaselwa kwe-zero-day, ngokusekelwe kuhlalutyo lwe-heuristic ye-traffic kunye neprofayili yenethiwekhi eqhelekileyo;
- imodyuli UkuSebenza kokuSebenza - ukubeka esweni ukusebenza kwezicelo zenethiwekhi ngaphandle kokufaka "ii-arhente" kunye neenkqubo ezichaphazelayo;
- imodyuli Irekhoda yeTrafikhi - ukurekhoda amaqhekeza etrafikhi yenethiwekhi ngokweseti yemithetho echazwe kwangaphambili okanye ngokwe-trigger esuka kwimodyuli ye-ADS, ukujongana neengxaki ezingaphezulu kunye / okanye uphando lweziganeko zokhuseleko lolwazi;
- imodyuli DDoS Protection - ukukhuselwa kwe-perimeter yenethiwekhi kwi-volumetric DoS / DDoS yokukhanyela ukuhlaselwa kwenkonzo, kubandakanywa nokuhlaselwa kwezicelo (OSI L3 / L4 / L7).
Kweli nqaku, siza kujonga indlela yonke into esebenza ngayo kusetyenziswa umzekelo weemodyuli ezi-2 - UkuJonga ukuSebenza kweNethiwekhi kunye noDiagnostics ΠΈ Ukhuseleko lokuFumana okungaqhelekanga.
Idatha yokuqala:
- Iseva yeLenovo RS 140 ene-VMware 6.0 hypervisor;
- Flowmon Umqokeleli wenyani umfanekiso womatshini onokuthi ukwazi ;
- iiswitshi ezimbini ezixhasa iiprothokholi zokuhamba.
Inyathelo 1. Faka i-Flowmon Collector
Ukusasazwa komatshini wenyani kwi-VMware kwenzeka ngendlela esemgangathweni ngokupheleleyo ukusuka kwitemplate ye-OVF. Ngenxa yoko, sifumana umatshini obonakalayo osebenzisa i-CentOS kunye nesoftware elungele ukusetyenziswa. Iimfuno zezibonelelo zinobuntu:
Ekuphela kwento eseleyo kukwenza uqaliso olusisiseko usebenzisa umyalelo sysconfig:
Siqwalasela i-IP kwi-port yolawulo, i-DNS, ixesha, i-Hostname kwaye inokudibanisa kwi-interface ye-WEB.
Inyathelo 2. Ukufakwa kwelayisensi
Ilayisensi yolingo yenyanga enye enesiqingatha iyenziwa kwaye ikhutshelwe kunye nomfanekiso womatshini wenyani. Ilayishwe nge Iziko Loqwalaselo -> Ilayisensi. Ngenxa yoko sibona:
Zonke zilungile. Ungaqalisa ukusebenza.
Inyathelo 3. Ukumisela umamkeli kumqokeleli
Kweli nqanaba, kufuneka wenze isigqibo sokuba isistim iya kufumana njani idatha kwimithombo. Njengoko besesitshilo ngaphambili, le inokuba yenye yeendlela zokuhamba okanye izibuko le-SPAN kwiswitshi.
Kumzekelo wethu, siya kusebenzisa ulwamkelo lwedatha usebenzisa iiprotocol I-NetFlow v9 kunye ne-IPFIX. Kule meko, sichaza idilesi ye-IP yojongano loLawulo njengento ekujoliswe kuyo - 192.168.78.198. I-Interfaces eth2 kunye ne-eth3 (ngohlobo lwe-Monitoring interface) zisetyenziselwa ukufumana ikopi ye-traffic "ekrwada" kwi-port ye-SPAN yokutshintsha. Siyabavumela badlule, hayi imeko yethu.
Emva koko, sijonga i-port yomqokeleli apho i-traffic kufuneka ihambe khona.
Kwimeko yethu, umqokeleli uphulaphule i-traffic kwi-port UDP / 2055.
Inyathelo 4. Ukuqwalasela izixhobo zenethiwekhi zokuthumela ngaphandle
Ukuseta i-NetFlow kwizixhobo zeCisco Systems mhlawumbi kunokubizwa ngokuba ngumsebenzi oqheleke ngokupheleleyo nakuwuphi na umlawuli wothungelwano. Umzekelo wethu, siza kuthatha into engaqhelekanga. Umzekelo, i-router yeMikroTik RB2011UiAS-2HnD. Ewe, ngokungaqhelekanga, isisombululo esinjalo sohlahlo lwabiwo-mali lweeofisi ezincinci kunye nezasekhaya zikwaxhasa i-NetFlow v5/v9 kunye ne-IPFIX protocol. Kwizicwangciso, misela injongo (idilesi yomqokeleli 192.168.78.198 kunye ne-port 2055):
Kwaye yongeza zonke iimetriki ezikhoyo zokuthunyelwa ngaphandle:
Kweli nqanaba sinokuthi ukuseta okusisiseko kugqityiwe. Sijonga ukuba itrafikhi ingena kwinkqubo.
Inyathelo lesi-5: Uvavanyo kunye nokuSebenza iModyuli yokuJonga iNtsebenzo yeNethiwekhi kunye neDiagnostics
Unokujonga ubukho betrafikhi ukusuka kumthombo kwicandelo Iziko lokuJonga i-Flowmon -> Imithombo:
Siyabona ukuba idatha ingena kwinkqubo. Ngexesha elithile emva kokuba umqokeleli eqokelele itrafikhi, iiwijethi ziya kuqala ukubonisa ulwazi:
Inkqubo yakhiwe kumgaqo wokugoba. Oko kukuthi, umsebenzisi, xa ukhetha isiqwenga somdla kumzobo okanye igrafu, "iwela" kwinqanaba lobunzulu bedatha ayidingayo:
Phantsi kulwazi malunga noqhagamshelo lwenethiwekhi nganye kunye noqhagamshelo:
INyathelo 6. Imodyuli yoKhuseleko lwe-Anomaly Detection
Le modyuli inokubizwa ngokuba yenye yezona zinto zinomdla kakhulu, enkosi kusetyenziso lweendlela ezingasayinwayo zokufumana izinto ezingaqhelekanga kwitrafikhi yenethiwekhi kunye nomsebenzi ongalunganga womnatha. Kodwa oku akuyo-analogue ye-IDS/IPS iinkqubo. Ukusebenza kunye nemodyuli kuqala "ngoqeqesho" lwayo. Ukwenza oku, iwizadi ekhethekileyo ichaza onke amacandelo aphambili kunye neenkonzo zenethiwekhi, kubandakanya:
- iidilesi zesango, iDNS, iDHCP kunye neeseva zeNTP,
- idilesi kumsebenzisi kunye necandelo leseva.
Emva koko, inkqubo iya kwimodi yoqeqesho, ehlala kumyinge ukusuka kwiiveki ezi-2 ukuya kwinyanga enye. Ngeli xesha, inkqubo ivelisa i-traffic esisiseko ethe ngqo kwinethiwekhi yethu. Ukubeka nje, inkqubo ifunda:
- Yeyiphi indlela yokuziphatha eqhelekileyo kwiindawo zenethiwekhi?
- Yeyiphi imiqulu yedatha egqithiselwayo kwaye iqhelekile kuthungelwano?
- Liliphi ixesha eliqhelekileyo lokusebenza kubasebenzisi?
- zeziphi izicelo ezisebenza kwinethiwekhi?
- nokunye okuninzi..
Ngenxa yoko, sifumana isixhobo esichonga nakuphi na ukungahambi kakuhle kuthungelwano lwethu kunye nokunxaxha kwindlela yokuziphatha eqhelekileyo. Nantsi imizekelo embalwa ethi inkqubo ikuvumela ukuba uyibhaqe:
- ukuhanjiswa kwe-malware entsha kwinethiwekhi engakhange ibonwe ngokusayinwa kwe-antivirus;
- ukwakha i-DNS, i-ICMP okanye ezinye iitonela kunye nokudlulisa idatha ngokudlula i-firewall;
- ukubonakala kwekhompyutheni entsha kwinethiwekhi ezenza i-DHCP kunye / okanye iseva ye-DNS.
Makhe sibone ukuba ikhangeleka njani bukhoma. Emva kokuba inkqubo yakho iqeqeshiwe kwaye yakha isiseko setrafikhi yenethiwekhi, iqala ukufumanisa izehlo:
Iphepha eliphambili lemodyuli ngumda wexesha elibonisa iziganeko ezichongiweyo. Kumzekelo wethu, sibona i-spike ecacileyo, malunga ne-9 kunye ne-16 iiyure. Masiyikhethe kwaye sijonge ngakumbi.
Ukuziphatha okungaqhelekanga komhlaseli kwinethiwekhi kubonakala ngokucacileyo. Konke kuqala ngento yokuba umamkeli onedilesi 192.168.3.225 waqala ukuskena okuthe tyaba kwenethiwekhi kwi-port 3389 (inkonzo ye-RDP ye-Microsoft) kwaye wafumana "amaxhoba" anokuba li-14:
ΠΈ
Esi siganeko sirekhodiweyo silandelayo - umamkeli 192.168.3.225 uqalisa uhlaselo olungenalusini lokunyanzela amagama ayimfihlo kwinkonzo yeRDP (kwizibuko 3389) kwiidilesi ezichongiweyo ngaphambili:
Njengomphumo wohlaselo, i-anomaly ye-SMTP ifunyenwe kwenye yeenginginya eziqhekekileyo. Ngamanye amazwi, i-SPAM iqalile:
Lo mzekelo ubonisa ngokucacileyo amandla enkqubo kunye nemodyuli yoKhuseleko lwe-Anomaly Detection ngokukodwa. Zigwebe ngokwakho ukusebenza kwakho. Oku kuqukumbela ushwankathelo olusebenzayo lwesisombululo.
isiphelo
Makhe sishwankathele ukuba zeziphi izigqibo esinokufikelela kuzo malunga ne-Flowmon:
- I-Flowmon sisisombululo se-premium kubathengi beenkampani;
- ngenxa yobuninzi bayo kunye nokuhambelana, ukuqokelela idatha kufumaneka kunoma yimuphi umthombo: izixhobo zenethiwekhi (iCisco, iJuniper, i-HPE, iHuawei ...) okanye i-probes yakho (i-Flowmon Probe);
- Izakhono zokulinganisa isisombululo zikuvumela ukuba ukwandise ukusebenza kwenkqubo ngokongeza iimodyuli ezintsha, kunye nokwandisa imveliso ngokubonga kwindlela eguquguqukayo yokufumana ilayisenisi;
- ngokusebenzisa itekhnoloji yohlalutyo lwasimahla, inkqubo ikuvumela ukuba ubone uhlaselo lweentsuku zero nokuba lungaziwa kwii-antivirus kunye neenkqubo ze-IDS/IPS;
- sibulela ukugqiba "ukungafihli" ngokufakela kunye nobukho benkqubo kwinethiwekhi - isisombululo asichaphazeli ukusebenza kwamanye ama-node kunye namacandelo eziseko zakho ze-IT;
- I-Flowmon yisisombululo kuphela kwiimarike ezixhasa ukujongwa kwetrafikhi ngesantya ukuya kwi-100 Gbps;
- I-Flowmon sisisombululo sothungelwano lwaso nasiphi na isikali;
- elona xabiso lilungileyo / umlinganiselo wokusebenza phakathi kwezisombululo ezifanayo.
Kolu hlaziyo, sivavanye ngaphantsi kwe-10% yokusebenza ngokupheleleyo kwesisombululo. Kwinqaku elilandelayo siza kuthetha malunga neemodyuli eziseleyo ze-Flowmon Networks. Ukusebenzisa imodyuli yokuHlola ukuSebenza kweSicelo njengomzekelo, siya kubonisa indlela abalawuli bezicelo zeshishini abanokuqinisekisa ukufumaneka kwinqanaba elinikeziweyo le-SLA, kunye nokuxilonga iingxaki ngokukhawuleza.
Kwakhona, singathanda ukukumema kwi-webinar yethu (10.09.2019/XNUMX/XNUMX) ezinikele kwizisombululo zomthengisi we-Flowmon Networks. Ukuze ubhalise kwangaphambili, siyakucela .
Kuphelele apho okwangoku, enkosi ngomdla wakho!
Ngabasebenzisi ababhalisiweyo kuphela abanokuthatha inxaxheba kuphando. , ndiyacela.
Ngaba usebenzisa iNetflow ukujonga inethiwekhi?
-
ukuba
-
Hayi, kodwa ndiceba ukwenza njalo
-
akukho
Bangama-9 abasebenzisi abavotileyo. Abasebenzisi abangama-3 abakhange.
umthombo: www.habr.com