Ukuhlaziywa kwemishini yenethiwekhi: amathuluzi, ithrafikhi, kanye nokuphepha

Ukuqonda okwenzekayo ngempela ngaphakathi kwenethiwekhi yedatha Kubalulekile namuhla, kungakhathaliseki ukuthi sikhuluma ngebhizinisi elincane, inhlangano enkulu yezimboni, noma indawo yedijithali nje njengezokuxhumana. Nsuku zonke, izinkulungwane zamaphakethe edatha zijikeleza phakathi kwamakhamera e-IP, amaseva, ama-router, amaswishi, omakhalekhukhwini, namakhompyutha, kanye nokukhiqiza, ukuphepha, futhi, ezimweni eziningi, ibhizinisi ngokwalo lincike kulowo mgwaqo.

Uma sikhuluma ngakho ukuhlaziywa kwemishini yenethiwekhi Asikhulumi nje ngokubheka amagrafu e-bandwidth: kuhilela ukufunda amaphrothokholi, ukusebenza, amaphutha, ukuphepha, amadivayisi angokoqobo, ngisho nokuziphatha komsebenzisi. Kusukela kukhamera ye-PoE IP egalaji kuya ku-NetFlow-based monitoring suite noma i-protocol analyzer efana ne-Wireshark, konke kuyasiza ukuze kutholakale ukubonakala kwangempela kokwenzekayo futhi kukwazi ukuthatha isinyathelo ngaphambi kokuba kugadle inhlekelele.

Kuyini ngempela ukuhlaziywa kwethrafikhi yenethiwekhi kanye nemishini?

Ukuhlaziywa kwenethiwekhi kuyinqubo yokubuka, ukuthwebula, nokufunda ithrafikhi nesimo sedivayisi. eziyingxenye yengqalasizinda, kungaba yinkampani, izimboni, noma ngisho nenethiwekhi yezokuxhumana yedijithali. Umgomo ucacile: ukuthola amaphutha, izithiyo, izinsongo, ukwakheka okunephutha, noma ingqalasizinda esiphelelwe yisikhathi ngaphambi kokuba kubangele ukungasebenzi noma ukwephulwa kwezokuphepha.

Esimweni sebhizinisi esijwayelekile, ukuhlaziywa kugxile ku Ukufinyelela i-inthanethi, amaseva, amaswishi, izindawo zokufinyelela i-Wi-Fi, kanye nezindawo zokusebenzaYilapho inani elikhulu kakhulu lethrafikhi livame ukugxila khona, ngakho-ke lapho kuvela khona izinkinga eziningi zokusebenza kanye nokuphepha. Nokho, kumanethiwekhi ezimboni, ubunzima buvela ezinhlobonhlobo ezinkulu zezinqubo ezithile (i-Modbus, i-DNP3, nezinye ezizimele), ezidinga amathuluzi akwazi ukuhumusha ozimele abahlukahlukene kakhulu futhi abavame ukungabhalwa kahle.

Ngaphezu kwezici zobuchwepheshe kuphela, Ukuhlaziywa kwenethiwekhi kukhule kwaze kwaba semkhakheni wezokuxhumana kanye nedatha evulekileLapha, kugxilwe ekumeleleni nasekufundeni ubudlelwano phakathi kwabantu, izinhlangano, noma amazwe kusetshenziswa amagrafu, ukuhlonza amaphethini ethonya, ubuningi bokuxhumana, noma ama-node aphakathi. Nakuba umongo uhlukile, ifilosofi iyafana: ukuqoqa idatha yenethiwekhi, ukuyihlaziya, nokufinyelela iziphetho eziwusizo.

Ukubaluleka kwezomnotho kokwenza izinto ngendlela efanele kusobala: Izindleko ezimaphakathi zomhlaba wonke zokwephulwa kwedatha ziyizigidi eziningana zamaRandi Ngokusho kwemibiko yakamuva, futhi yize inani lehlile kancane ngenxa yokusetshenziswa okukhulu kwezinhlelo zokuthola nokuphendula, kusengumthelela omubi kunoma iyiphi inhlangano ekuthatha kalula.

Izinhlobo ze-network analyzers: ihadiwe nesofthiwe

Amathuluzi okuhlaziya inethiwekhi ahlukaniswe kabanzi ngezixazululo zesofthiwe kanye nemishini yehadiwe ezinikele.Indlela ngayinye inenkundla yayo yokudlala, izinzuzo kanye nemikhawulo, futhi kubalulekile ukuqonda ukuthi ngayinye ifanelana kuphi.

I-Los isofthiwe yokuhlaziya inethiwekhi Lezi ngokuvamile ziyizinhlelo zokusebenza ezijwayelekile ezenzelwe ukusebenza namaphrothokholi asetshenziswa kabanzi futhi abhalwe kahle. Izibonelo ezijwayelekile zifaka phakathi i-Wireshark, i-TCPDump, kanye ne-WinDump. Ngokuvamile zingamathuluzi wamahhala noma omthombo ovulekile futhi zilungele izindawo zebhizinisi zendabuko, amanethiwekhi e-IP ajwayelekile, kanye nemisebenzi yansuku zonke yokuxilonga noma yokuhlolwa kwezifo.

Ngakolunye uhlangothi, Abahlaziyi behadiwe ngamadivayisi akhethekile angokwenyamaLezi zenzelwe izindawo ezinezinqubo ezithile noma zezimboni. Ngokuvamile ziyimikhiqizo ekhokhelwayo ngoba zihlanganisa izinto zikagesi ezikhethekile futhi zivame ukudinga amalayisense ezinqubo ezingakwazi ukuzichaza. Izixazululo ezifana ne-Achilles, i-NetDecoder, i-LineEye, kanye neminye imishini efanayo ziwela kulesi sigaba. Ngaphezu kokuhlaziya ithrafikhi, zingasebenza futhi njengezinto zokufaka amaphrothokholi, ama-oscilloscope, abahlaziyi besignali, noma abakhiqizi bethrafikhi abalawulwayo.

Kumanethiwekhi ehhovisi, kuvamile ukusebenzisa isofthiwe yokuhlaziya.Lokhu kwanele ukubona ukuthi kwenzekani nge-HTTP, i-DNS, i-TCP, i-TLS, i-VoIP, njll. Kodwa-ke, ezinhlelweni zokulawula zezimboni, amanethiwekhi e-SCADA, noma ezenzakalelayo, indinganiso iyi-hardware analyzer, ngoba amaphrothokholi amaningi awavuleki noma asetshenziswa kabanzi, futhi amadivayisi akwazi ukuwaqonda ezingeni eliphansi nokuqinisekisa ukusetshenziswa kwawo okulungile ayadingeka.

Kuzo zombili izimo, amathuluzi awagcini nje “ekulaleleni”: Ezimweni eziningi bayakwazi ukufaka ithrafikhi, baphinde badale amaphutha ephrothokholi, futhi baqinisekise ukuziphatha kwemishini.Lokhu kubalulekile uma ufuna ukuqinisekisa ukuqina kwesitshalo sezimboni noma inethiwekhi ebalulekile ngaphandle kokufaka engcupheni umkhiqizo.

Indlela abahlaziyi ababamba ngayo ithrafikhi: ihabhu, i-mirror port, kanye ne-TAP

Ukuze uhlaziye inethiwekhi, udinga ukuqinisekisa ukuthi ithrafikhi ifinyelela ku-analyzer.Futhi lokho akwenzeki ngomlingo. Kuye ngokuthi sikhuluma ngamathuluzi esofthiwe noma ehadiwe, amasu namadivayisi ahlukene asetshenziswa ukukopisha noma ukuqondisa kabusha ukuxhumana kuze kufike lapho kufundwa khona.

Lapho usebenzisa i- i-analyzer yohlobo lwesofthiweUma isifakiwe kwi-PC noma kuseva, uhlelo ludinga ukukwazi "ukubona" ​​amaphakethe esifuna ukuwahlaziya. Inketho ejwayelekile, nakuba ingavamile kakhulu, ukusebenzisa i-concentrator noma ihabhuIhabhu ixhunywe engxenyeni yenethiwekhi, futhi i-analyzer ixhunywe kwenye yama-port ayo amahhala. Ihabhu iphinda yonke ithrafikhi kuwo wonke ama-port, ngakho isofthiwe ithola ikhophi yalokho okwenzekayo. Inkinga ukuthi Amandla ale ndlela alinganiselwe futhi awasebenzi kahlefuthi ama-hub acishe athathelwe indawo ngokuphelele yizinkinobho.

Indlela esetshenziswa kakhulu namuhla Ukulungiselela imbobo yesibuko (i-SPAN, imbobo yesibuko) kuswishi ephethweI-port ibizwa ngokuthi isibuko futhi iyalwa ukuba ikopishe yonke ithrafikhi kusuka ku-interface eyodwa noma ngaphezulu (noma ngisho nama-VLAN) iye kuleyo port, lapho i-analyzer ixhunywe khona. Lokhu kuvumela isofthiwe ukuthi iqaphe ithrafikhi ethakaselwayo ngaphandle kokuphazamisa ukukhiqizwa. Kodwa-ke, kubalulekile ukukhumbula ukuthi Uma ivolumu yephakethe iphezulu kakhulu, imbobo yesibuko ingase igcwale. futhi akuzona zonke izinto ezizobanjwa.

Emkhakheni wehadiwe ezinikele, okulandelayo kuyasetshenziswa: I-TAP Yenethiwekhi (Indawo Yokufinyelela Yokuhlola)Ama-TAP amadivayisi amancane angokoqobo aklanyelwe ukukopisha ithrafikhi egeleza phezu kwesixhumanisi bese eyithumela kwelinye noma ngaphezulu amachweba okuqapha. I-TAP ngokuvamile ingasebenza nemidiya ehlukene (i-Ethernet, i-fiber, i-RS-232, i-RS-485, njll.) futhi ixhumeka kuthuluzi lokuhlaziya nge-USB noma esinye isikhombimsebenzisi. Inzuzo eyinhloko ukuthi Akuxhomekile ekucushweni kweswishi futhi kuklanyelwe ukuba kubonakale ngokuphelele., okwenza kube ukukhetha okuvamile kumanethiwekhi abalulekile noma ezimboni.

Nakuba abahlaziyi besofthiwe begxila kakhulu ku Khomba amaphrothokholi, imvelaphi, izindawo oya kuzo, kanye nezibalo zethrafikhiAmadivayisi ehadiwe aya phambili, enezela izici ezifana nokukhiqizwa ngobuningi kwamafreyimu angasebenzi ukuhlola ukubekezelelana kwedivayisi, ukulinganiswa kwezinga likagesi, kanye nokuhlaziywa kwesignali yomsakazo. Ngokubuyisela, isofthiwe ngokuvamile inikeza ikhono lokuhlaziya ukuthwebula okugcinwe ngaphambilini, isici esilinganiselwe kakhulu noma esingekho kubahlaziyi abaningi behadiwe.

Abahlaziyi benethiwekhi ezindaweni zezimboni nezokulawula

Ezinhlelweni zokulawula zezimboni, ezenzakalelayo, kanye namanethiwekhi e-SCADA, ukukhetha imishini yokuhlaziya ihadiwe cishe kuyimpoqo.Isizathu silula: ingxenye enkulu yamaphrothokholi asetshenziswayo ayivulelekile, ayisakazwa kabanzi, noma ayinazo izindlela ezithile zokusebenzisa, ngakho-ke amathuluzi ajwayelekile awakwazi ukuwachaza kahle.

Abakhiqizi balezi zinhlobo zezixazululo banikeza amadivayisi akwazi ukuqonda isethi ethile kakhulu yezinqubo zezimboniIzinqubo ezisakazeke kakhulu—njengeModbus, DNP3, nezinye—zivamise ukumbozwa kahle, kodwa futhi kunemikhiqizo ekhethekile kakhulu eqondiswe kunqubo ethile noma ngisho nomndeni othile wemishini. Akuyona nje indaba "yokubheka amaphakheji," kodwa ukuqinisekisa ukuthi ukusetshenziswa kwenqubo kulungile kudivayisi ngayinye.

Ngale njongo, laba bahlaziyi behadiwe Abagcini nje ngokulalela ithrafikhi yangempela, kodwa futhi bakhiqiza futhi bafake ozimele bokuhlola kunethiwekhi, eziningi zazo ezingalungile, ezingaphelele, noma ezinezinkambu ezidlulele, ngenhloso yokuthola amaphutha kanye nobuthakathaka bokuphepha. Lo msebenzi ophazamisa iphrothokholi ungenye yezinto eziyinhloko ezihlukanisayo uma kuqhathaniswa namathuluzi esofthiwe ajwayelekile.

Kudingeka siqaphele, ngoba Lokhu kuhlolwa kokuqina kungaholela ezinhlelweni ezimweni ezingazinzileNgakho-ke, kunconywa ukuthi ukuqinisekiswa kokusetshenziswa kwephrothokholi kwenziwe njalo ezindaweni zokuhlola noma ngezikhathi ezithile lapho isitshalo noma uhlelo oluyinhloko lungakhiqizi. Ngaphandle kwalokho, ukugcwala kwamaphakethe angasebenzi kungabangela ukuvalwa okungafuneki kanye nesidingo sokuqala kabusha ngokuphelele.

Ngokuphambene nalokho, ukusetshenziswa kwama-analyzer ukuqapha ithrafikhi ezokuthutha, ngaphandle kokufakwa kohlaka olunamandla, Akufanele kube nezinkinga ezibalulekile ekusebenzeni kwenethiwekhi yezimboningaphezu kwesikhathi esidingekayo sokufaka imishini endaweni efanele yokubamba. Yingakho sebebe ngabalingani abayisisekelo babaphathi be-OT (Operational Technology) emafektri, ingqalasizinda ebalulekile, kanye nezitshalo zokukhiqiza.

Ukuhlola inethiwekhi yenkampani: ingqalasizinda kanye nezici ezibalulekile

Ukuhlaziya inethiwekhi yenkampani kudlulela ngalé kokubheka nje ithrafikhi ye-IP ngethuluzi.Ukuhlolwa kwenethiwekhi okujulile kuhilela ukubuyekeza ingqalasizinda ebonakalayo, ukwakheka okunengqondo, ukuphepha, amadivayisi axhunyiwe, kanye nezinhlelo zamandla kanye nezimo eziphuthumayo, phakathi kwezinye izici.

Isinyathelo sokuqala ngokuvamile si- ukuhlolwa kwengqalasizinda ye-IT okupheleleLapha, zonke ihadiwe yenkampani ziyabuyekezwa: amaseva (angokoqobo nawangempela): ukuxhumana ku-Hyper‑V, VirtualBox kanye ne-VMwareLokhu kufaka phakathi imishini yomsebenzisi, ama-router, amaswishi, izindawo zokufinyelela ze-Wi-Fi, amakhamera e-IP, amaphrinta enethiwekhi, ama-firewall, amaphaneli e-patch, nanoma yimaphi amanye amadivayisi axhunyiwe. Umgomo ukuthola imishini ephelelwe yisikhathi, ihadiwe engasekelwa, ukucushwa okungavikelekile, kanye nezinkinga ezingaba khona.

Iphuzu elilodwa elibucayi kakhulu yileli iseva kanye negumbi lokuxhumanaLena yinhliziyo yenethiwekhi, lapho kuhlala khona amaseva amakhulu, amaswishi ayisisekelo, ama-firewall, i-router yesango le-inthanethi, futhi, ezimweni eziningi, isitoreji esiphakathi. Uma uhlaziya le ndawo, kufanele unake izinga lokushisa elizungezile, ukuhlanzeka kanye nothuli oluqongelelekile, isimo sezintambo, ukuhlelwa kwamakhabethe e-rack, ukuba khona kwamalebula acacile futhi afinyelelekayo, kanye nesimo se-router eyinhloko kanye ne-firewall ejikelezayo.

Ngokuphathelene nokufinyelela i-inthanethi, kufanelekile ukuhlola ukuthi Umhlinzeki unikeza uxhumano oluzinzile noluphephile olunamandla anele kanye nobuchwepheshe obusha.Izici ezifana nokulawulwa kwe-bandwidth, ukuba khona kwamachweba e-Gigabit Ethernet emishinini esemaphethelweni, nokuthi izintambo ezifika kuyo zisesigabeni esifanele yini ukuze kugwenywe ukukhawulela isivinini nazo ziyabuyekezwa.

Ngaphakathi kwenethiwekhi yangaphakathi, enye yezinto ezibaluleke kakhulu yilezi amaswishi okufinyelela nokusabalalisaKunconywa ukuqinisekisa ukuthi awusebenzisi imishini esidala engakwazi ukusebenza ku-1 Gbps kuzo zonke izimbobo, njengoba lokhu kungaba yisithiyo esithule esithinta kabi ukusebenza kwenethiwekhi iyonke. Ngaphezu kwalokho, buyekeza i-VLAN, i-QoS, kanye nokucushwa kokuphepha (isibonelo, ukukhubaza izimbobo ezingasetshenziswanga, ukuvikela ekuhlaselweni kwesiphepho sokusakaza, njll.).

Izindawo zokufinyelela ze-Wi-Fi, izintambo, kanye namandla okusekelayo

Ama-access points (ama-AP) abonakala ebusweni benethiwekhi kubasebenzisi abaningiNjengoba amadivayisi amaningi evame ukuxhuma nge-Wi-Fi, ukuhlaziywa okuhle kwenethiwekhi kuhlanganisa ukubuyekeza indawo yezindawo zokufinyelela, ukumbozwa kwangempela, ukuphazamiseka, ukugqagqana kweziteshi, kanye nomthamo weseli ngayinye engenantambo.

Kubalulekile ukuthi Izindawo zokufinyelela zisendaweni efanele Ukuqinisekisa ukuthi isignali ifinyelela kuzo zonke izindawo zenkampani ngaphandle kwezikhala zokumboza noma ukugcwala ngokweqile ezindaweni ezithile, ukucushwa kokuphepha (i-WPA2/WPA3, ukuqinisekiswa, ukuhlukaniswa kwenethiwekhi yezivakashi, njll.) kanye nokuhlanganiswa kwezindawo zokufinyelela nezinye izingqalasizinda (abalawuli be-WLAN, ama-VLAN ahlobene, kanye nekhwalithi yezinqubomgomo zesevisi) nakho kuyahlolwa.

Uhlobo lwezintambo ezisetshenzisiwe luyisici esibalulekile: Kunconywa ukusebenza okungenani ngezigaba 5e noma 6, futhi uma kungenzeka, ngezigaba eziphakeme. Ukusekela isivinini esiphezulu nokulungiselela ukuthuthukiswa kwesikhathi esizayo. Ngaphezu kwalokho, kubalulekile ukuhlola isimo sezixhumi ze-RJ45 nama-jack, njengoba ukugoba okungekuhle noma indawo yokuxhuma eyonakele kungabangela amaphutha ngezikhathi ezithile okunzima kakhulu ukuwathola uma engashiywanga enganakiwe.

Ngokuphathelene nokuqhubeka kwenkonzo, ukuba ne- I-UPS (Uninterruptible Power Supply) Kubalulekile emishinini ebalulekile: amaseva, ama-core switch, ama-router, ama-firewall, kanye nezinhlelo zokugcina. Uma kwenzeka ugesi unqamuka, i-UPS inikeza isikhathi esidingekayo sokuvala izinhlelo ngomusa noma ukuze eminye imithombo yamandla ithathe izintambo, ukuvimbela ukulahleka kwedatha kanye nomonakalo wehadiwe.

Iseva noma amaseva ayinhloko nawo adinga ukuhlolwa ngokucophelela: Indawo yayo kufanele ivumele ukufinyelela okusheshayo nokuphephile ngokomzimba.Kumelwe zibe noxhumano lwe-Gigabit (noma ngaphezulu), zivikelwe yi-UPS, futhi zibe nohlelo lokupholisa olwanele olugcina amazinga okushisa ngaphakathi kwebanga elinconywe ngumenzi. Ngaphandle kwalokho, noma yikuphi ukunyuka kokushisa kungabangela ukwehluleka ngezikhathi ezithile noma ukwehla kokusebenza.

Amadivayisi axhunyiwe, ukuphepha kwenethiwekhi, kanye nokuqhubeka kwebhizinisi

Esinye isici esibalulekile ekuhlaziyweni kwenethiwekhi yenkampani yimpahla kanye nokulawulwa kwamadivayisi axhunyiwe.Ukwazi ukuthi yini ehlobene, nini futhi kuphi kubalulekile kokubili ekuphepheni nasekuphathweni kwezinsiza.

Ngokuskena okulawulwayo, izinhlelo zokuqapha, kanye nokubuyekezwa okwenziwa njalo, kutholwa ukuthi yimaphi amadivayisi asebenzayo kunethiwekhi, ukuthi yimaphi amakheli e-IP asebenzisayo, yiziphi izinsizakalo azidalulayo, nokuthi ngabe agunyaziwe yini. Lokhu kuvumela thola amadivayisi “ezipoki”, imishini yomuntu siqu engagunyaziwe, noma amadivayisi e-IoT angalungiselelwe kahle okungaba yingozi enkulu uma kungaphathwa kahle.

Ukuhlolwa kokuphepha kwenethiwekhi kufaka phakathi ukubuyekezwa kwe uhlelo olunengqondo (ukuhlukaniswa, ama-VLAN, izindawo ezingenamasosha)Amandla amaphasiwedi, ukucushwa kwama-firewall kanye nezinhlelo zokuvikela i-anti-malware, kanye nokuba khona kwezinqubomgomo zokuvuselela isofthiwe ecacile kanye ne-firmware, konke kuyahlaziywa. Izinhlelo zokulondoloza idatha—zasendaweni, zenethiwekhi, noma ezisekelwe efwini—kanye nezinhlelo zokulungisa inhlekelele nazo ziyahlolwa.

Esinye isici esibalulekile siwukuba ukufinyelela okunye kwi-inthanethi (isibonelo, umhlinzeki wesibili noma uxhumano lwe-4G/5G oluyisipele) oluvumela imisebenzi eyisisekelo ukuthi iqhubeke, noma ngabe inqunyelwe, uma uxhumano oluyinhloko luhluleka. Ezinkampanini eziningi, ukuba nethimba labo lonke lingasebenzi amahora amaningana kungaholela ekulahlekelweni okukhulu, kokubili ngokwezimali kanye nedumela.

Okokugcina, kuyalulekwa ukusungula ukuqapha okuqhubekayo kanye nezinqubo zokukhiqiza i-alamu ezixwayisa ngokushesha lapho imingcele ethile ye-bandwidth, i-CPU, inkumbulo, ukubambezeleka, noma ukulahleka kwephakethe kudlulwa, noma lapho kutholwa amaphethini ethrafikhi angajwayelekile. Lokhu kuvumela ithimba le-IT ukuthi lisabele ngokushesha futhi livimbele inkinga evelayo ekubeni yisigameko esingathi sína.

Amathuluzi okuqapha, izinqubo zokuphatha, kanye namamodeli omjikelezo wokuphila

Ukuphathwa kwenethiwekhi yesimanje kuncike kusethi ebanzi yamaphrothokholi namathuluzi lokho akuvumeli nje kuphela ukuqapha, kodwa futhi nokuhlela nokwenza ngcono ingqalasizinda kuyo yonke impilo yayo.

Uhlaka olujwayelekile lokubhekisela ekuchazeni Umjikelezo wokuphila kwenethiwekhi uyimodeli ye-PDIOO (Hlela, Ukuklama, Ukusebenzisa, Ukusebenzisa, Ukuthuthukisa). Kuchaza ngokucacile izigaba zokuhlela, ukuklama, ukusebenzisa, ukusebenza, kanye nokwenza ngcono okuqhubekayo. Ukuphathwa kwenethiwekhi kuwela ikakhulukazi ngaphakathi kwezigaba zokusebenza nokwenza ngcono, okuhlanganisa imisebenzi efana nokuphathwa kokucushwa, ukuphathwa kokutholakala, ukuphathwa kwamandla, ukuphathwa kokuphepha, kanye nokuphathwa kwezigameko.

Kulesi simo, okulandelayo kuyasetshenziswa amaphrothokholi okuphathwa kwenethiwekhi njenge-SNMP (Iphrothokholi Yokuphathwa Kwenethiwekhi Elula)I-SNMP ichaza ukwakheka okwakhiwa ngabaphathi, ama-ejenti, kanye nesisekelo solwazi lokuphatha (i-MIB) esivumela ukubuza nokuguqula amapharamitha edivayisi. Ithembele emiyalweni eyisisekelo kanye nezindlela ezifana ne-TRAPs, izaziso ezithunyelwa amadivayisi ohlelweni lokuphatha lapho kwenzeka isenzakalo esifanele. Ngokuhamba kwesikhathi, izinguqulo eziningana ze-SNMP zikhishwe, kanye nokuthuthukiswa kokuphepha kanye namakhono.

Enye indinganiso ehlobene yile I-RMON (Ukuqapha Inethiwekhi Ekude)I-RMON yadalelwa ukunqoba eminye yemikhawulo ye-SNMP ekuqapheni okude kanye nokuqoqwa kwezibalo zezinga lenethiwekhi ezinemininingwane. Ichaza ukwakheka kweklayenti-iseva kanye namaqembu olwazi ahlukene asebenza ezingqimbeni ezahlukene zemodeli ye-TCP/IP, enikeza amakhono okuhlaziya ithrafikhi athuthukile ngaphandle kokudinga ukufinyelela ngokomzimba engxenyeni efanayo yenethiwekhi.

Amathuluzi okuqapha angahlukaniswa ngezindlela eziningana: Ezentengiselwano uma kuqhathaniswa nomthombo ovulekile, ezigxile ekusebenzeni uma kuqhathaniswa nezokuphepha, ezisekelwe ekugelezeni uma kuqhathaniswa ne-batter probe ezisekelwe ku-njll. Lapho ukhetha, izici ezifana nosayizi wenethiwekhi, ukubaluleka kwesevisi, isabelomali esitholakalayo, kanye nezinga elifunekayo lokwenza okuzenzakalelayo kumele kucatshangelwe.

Ukuhlaziywa kokusebenza, izilinganiso, kanye nokugcinwa kokuvimbela

Ukuhlaziywa kokusebenza kwenethiwekhi kuyingxenye ebalulekile yomsebenzi wokuphathaAkwanele ukuthi "isebenze": kumele ikwenze lokho ngokubambezeleka, ukutholakala kanye namazinga okusebenza ahlangabezana nezidingo zebhizinisi.

Ukuhlela ukuhlaziywa kokusebenza okuhle kuhilela ukuchaza Izinkomba ezicacile kanye nezilinganisoLokhu kufaka phakathi amapharamitha enethiwekhi (i-bandwidth esetshenzisiwe, izinga lamaphutha, ukubambezeleka, i-jitter, ukulahleka kwephakethe), amapharamitha esistimu (ukusetshenziswa kwe-CPU, imemori, idiski, ukuxhumana okuhambisanayo) kanye namapharamitha esevisi (isikhathi sokuphendula kohlelo lokusebenza, ukutholakala okubonwa ngumsebenzisi, izinga lamaphutha anengqondo).

Ngale datha, ungenza izilinganiso eziphindaphindwayo, ukuhlaziywa kwemikhuba, kanye nokusebenzisa izindlela zokulungisaIsibonelo, uma ukukhula okuqhubekayo kwethrafikhi kutholakala kusixhumanisi esithile, ukunwetshwa komthamo noma ukusatshalaliswa kabusha kwensizakalo kungahlelwa ngaphambi kokuba kuvele izinkinga. Ngokufanayo, ukwanda okungazelelwe kwamaphutha ku-interface kungabonisa ukwehluleka kwezintambo noma imishini enephutha.

Ukugcinwa kokuvimbela kuyinhlanganisela yemvelo yokuhlaziywa kokusebenza. Kuhilela Hlela imisebenzi ejwayelekile ukuze ubuyekeze, ubuyekeze, futhi ulungise ingqalasizindaukunciphisa amathuba okwehluleka okungalindelekile. Lokhu kuhlanganisa ukuphatha ukuvalwa kokulungisa, ukuvumelana nezinhlelo zekhwalithi zenhlangano, ukubuyekeza i-firmware kumadivayisi okuxhumana, kanye nokwenza izivivinyo ezisebenzayo ngemuva kwezinguquko ezinkulu.

Ngaphezu kwalokho, ngaphakathi kwendawo yedatha kanye nesicelo, okulandelayo kuyasetshenziswa izinhlelo zokuphatha isizindalwazi, amathuluzi okuhlaziya ulwazi (ukumba idatha, i-OLAP, amadeshibhodi)Amathuluzi e-CASE, izilimi ze-4GL, kanye nobuchwepheshe obuhlukahlukene bokuxhumana (i-OLEDB, i-ODBC, i-JDBC, i-SQLJ, i-SQL/CLI) kusetshenziswa ukwenza ngcono ukusebenza kwezinhlelo zolwazi. Konke lokhu kunegalelo ekuqinisekiseni ukuthi inethiwekhi ayithuthi amaphakethe kuphela, kodwa yenza kahle futhi ihambisana nezidingo zebhizinisi.

Amathuluzi okuhlaziya amanethiwekhi omphakathi kanye negrafu: i-Gephi ne-NodeXL

Umqondo wokuhlaziywa kwenethiwekhi usebenza nasezinkundleni zokuxhumana nabantu kanye namagrafu obudlelwano.Lapha, esikhundleni sokulinganisa i-bandwidth noma i-latency, ama-node (abantu, izinhlangano, amazwe) kanye nemiphetho (ubudlelwano, ukusebenzisana, ukukhulunywa ngakho) kuyafundwa ukuze kuqondwe amandla okuguquguquka, izakhiwo zamandla, kanye namaphethini okuziphatha.

Cishe abantu abayizigidi ezingu-30 eSpain basebenzisa izinkundla zokuxhumana ngenkuthalo, bechitha cishe amahora amabili ngosuku kuzo. Lo msebenzi omkhulu wenza izinkundla zokuxhumana... umthombo wolwazi ononya, kodwa ongahlelekile kahleUkuze kuzuze, kubalulekile ukusebenzisa amathuluzi athile okuhlaziya inethiwekhi yokuxhumana nabantu, akwazi ukuveza amagrafu ngokubonakalayo nokubala izilinganiso ezifana nokuma, ubuningi, ukuba phakathi noma ukusondelana.

Elinye lamathuluzi aziwa kakhulu I-Gephi, isofthiwe yokuhlola nokubona ngeso lengqondo amanethiwekhi namagrafu ayinkimbinkimbi ngokusebenzisanaI-Gephi ikuvumela ukuthi usebenze ngamanethiwekhi anamandla nangokwezinga eliphezulu, uphathe amashumi ezinkulungwane zama-node kanye namakhulu ezinkulungwane zemiphetho usebenzisa amasu okuhlukanisa nokuhlunga, futhi isekela amafomethi amaningi okufaka (i-GDF, i-GML, i-Pajek NET, i-GEXF, i-GraphML, phakathi kwabanye). Iphinde ifake isethi ephelele yezibalo zokuhlaziywa kwenethiwekhi futhi ikuvumela ukuthi uthumele imibiko kanye nokubuka.

UGephi unayo izinto zosizo ezisemthethweni nezakhiwe ngumphakathi Itholakala ngamafomethi ahlukahlukene (umbhalo namavidiyo) kanye nezilimi eziningana, kufaka phakathi izibonelo ezisebenzayo. Iphinde ibe nezindawo zokugcina ezikhethekile ku-GitHub, izinkundla zezingxoxo zobuchwepheshe, kanye nokuba khona okusebenzayo kumanethiwekhi ochwepheshe, okwenza kube lula ukwamukelwa kwayo ngabacwaningi nabahlaziyi.

Elinye ithuluzi elibalulekile I-NodeXL, isandiso se-Microsoft Excel esigxile ekuhlaziyweni kwegrafu kanye nokumelwa kwayoI-NodeXL yakha ukuboniswa kwenethiwekhi kusuka ohlwini lokuxhumeka futhi inikeza amakhono okuhlaziya athuthukile ukuze ithole amaphethini kudatha. Enye yezinzuzo zayo ezinkulu ukuthi ifaka izixhumi eziqondile zokuhlaziya imithombo yezokuxhumana eku-inthanethi, ngokuhlanganiswa nama-API e-Twitter, Flickr, kanye ne-YouTube, okuvumela ukuqoqwa kwedatha okuzenzakalelayo kanye nokuhlaziywa okulandelayo.

I-NodeXL nayo inezici izifundo, imibhalo, izinkundla zabasebenzisi kanye nezinto zokuqeqesha kumapulatifomu ahlukene, kanye namaphrofayili asemthethweni ezinkundla zokuxhumana lapho kwabelwana khona ngezindaba, ama-webinar, kanye namacala okusetshenziswa. Konke lokhu kwenze kokubili amathuluzi okubhekisela eGephi kanye neNodeXL ochwepheshe bezenhlalo, ukumaketha, ukuxhumana, kanye nesayensi yedatha babe nesithakazelo ekuhlaziyweni kwenethiwekhi yokuxhumana.

Iyini ithuluzi lokuhlaziya inethiwekhi ye-IP futhi kungani ulidinga?

Emkhakheni wamanethiwekhi e-IP avamile, ithuluzi lokuhlaziya inethiwekhi liyisici esihlinzeka ngokubonakala kwangempela kulokho okwenzekayo.Ngaphandle kwayo, umphathi ubona izimpawu kuphela (izikhalazo zomsebenzisi, ukuhamba kancane, ukunqanyulwa kwenethiwekhi) kodwa hhayi imbangela eyinhloko.

Isixazululo esihle sokuhlaziya inethiwekhi sikuvumela ukuthi uhlole ithrafikhi ngomthombo, indawo oya kuyo, iphrothokholi kanye nohlelo lokusebenzaNgokusekelwe kulolu lwazi, izitayela zokusetshenziswa kwe-bandwidth zingabonakala, kunganqunywa ukuthi umsebenzi usemthethweni noma ungaba ukuhlasela, futhi kungaqinisekiswa ukuthi i-bandwidth etholakalayo isetshenziswa ngokubeka phambili izinhlelo zokusebenza ezibucayi zebhizinisi.

Amathuluzi esimanje ahamba phambili kunendlela yokuqapha evamile: Zinikeza umbono ophelele wamadivayisi, izixhumi, ama-IP, izinhlelo zokusebenza, izingxoxo, futhi, ezimweni eziningi, indawo. kwethrafikhi. Ngale ndlela, ukwanda kokusetshenziswa okungavamile, izithiyo eziqalayo, noma ngisho nengqalasizinda engazinzile kungatholakala ngaphambi kokuba kube ukuphazamiseka okubonakalayo kumsebenzisi.

Ithuluzi lokuhlaziya inethiwekhi elifanele kufanele likwazi ukuhlonza nokuxazulula izinkinga zokusebenza, ukuthola nokuvimbela izithiyo, ukuthola izinsongo zokuphepha zangaphakathi noma zangaphandleUkuhlonza imithombo eyinhloko yethrafikhi, ukuqapha ukusetshenziswa komkhawulokudonsa, isivinini senethiwekhi, kanye nokutholakala kwesevisi. Ngamafuphi, ukuyisa ukuqapha ezingeni elilandelayo.

Kulesi simo, kuvela izixazululo ezisekelwe ekugelezeni, njengokuthi I-NetFlow Analyzer, esebenzisa ubuchwepheshe obufana ne-NetFlow, i-sFlow, ne-IPFIX kanye namathuluzi afanayo okuthola ithrafikhi edlula kuma-router nama-switch bese ethula lolo lwazi ngendlela ecacile nesebenzayo eqenjini le-IT.

I-NetFlow Analyzer: Ukubonakala, Ukuphepha, kanye Nokusebenza

I-NetFlow Analyzer iyisibonelo somhlaziyi wenethiwekhi ophelele, osekelwe ekugelezeni.Lokhu kunikeza umphathi umbono oqhubekayo wokuthi "ngubani," "nini," nokuthi "yini" yethrafikhi yenethiwekhi. Iqapha amadivayisi, izixhumi, kanye nayo yonke imithombo kanye nekheli le-IP lendawo, ihlinzeka ngokubonakala kwesikhathi sangempela kulokho okusakazwa ngengqalasizinda.

Ithuluzi linikeza amashadi anemininingwane futhi angenziwa ngezifiso, amadeshibhodi, kanye nezibalo Ilandelela ukusetshenziswa kwe-bandwidth, izinhlelo zokusebenza eziyinhloko, abathumeli abayinhloko nabamukeli, izingxoxo ezijulile kakhulu, njll. Ngaphezu kwalokho, ifaka phakathi izinhlelo ze-alamu ezilungisekayo ezixwayisa lapho imingcele echazwe ngumlawuli idlula, ukuvimbela izinkinga ukuthi zinganakwa kuze kube sekwephuze kakhulu.

Esizindeni se-Wi-Fi, i-NetFlow Analyzer iyakwazi Gada abalawuli be-WLAN, ama-SSID, kanye nezindawo zokufinyelelaukukhiqiza imibiko ethile ngokuziphatha kwayo nokusiza ekutholeni ukugcwala, ukungalungiselelwa kahle, noma ukusetshenziswa kabi. Iphinde ivumele ukuhlaziywa kwamapharamitha abalulekile emidiya, i-VoIP, kanye nethrafikhi yevidiyo, ukuqinisekisa amazinga afanele esevisi kanye nokuqapha isikhathi sokuya nokubuya (RTT) sezixhumanisi ze-WAN ukuqinisekisa ukuxhumana okuhle namasayithi akude.

Ngokombono wokuphepha, ithuluzi lihlanganisa izici ezithuthukisiwe ze ukutholakala kwe-anomaly kanye nosongoI-Advanced Security Analysis Module yayo (i-ASAM) igxile ekuboneni ukuhlaselwa kwe-DDoS, ama-botnet, ama-scan, kanye nokunye ukungena okungenzeka ukuthi kudlule izivikelo ze-perimeter. Ngemibiko ye-forensic, ihlaziya nedatha yomlando ukuze ithole izinkinga ezithinta ukusebenza okuphelele noma ubuqotho benethiwekhi.

Ngokuphathelene nokwenza ngcono, i-NetFlow Analyzer iyasiza ukwenza hlukanisa ithrafikhi ngohlelo lokusebenza bese uphatha izinqubomgomo zekhwalithi yesevisi (QoS) ngesikhathi sangempela, ukuqinisekisa ukuthi izinhlelo zokusebenza ezibalulekile zibaluleke kakhulu kunethrafikhi engabalulekile kangako. Ngaphezu kwalokho, kuvumela ukuqinisekisa ukusebenza kahle kwalezi zinqubomgomo kusetshenziswa ubuchwepheshe obufana ne-Cisco CBQoS, okuqinisekisa ukuthi izinguquko zokucushwa zinomthelela ofiselekayo.

Ukuqapha okusatshalaliswayo kanye nokukhula kumanethiwekhi amakhulu

Njengoba ubukhulu kanye nobunzima benethiwekhi bukhula, ukuhlaziywa kwethrafikhi kuba nzima kakhulu.Uma inhlangano inezindawo eziningi, izixhumanisi ze-WAN, namagatsha akude, umbono wendawo akwanele.

Kulezo zimo, kunezinhlobo zezixazululo zebhizinisi ezifana ne-NetFlow Analyzer, yakhelwe izindawo ezisatshalalisiwe nezinomthamo omkhuluLezi zinhlelo zivumela ukuqapha amashumi ezinkulungwane zokugeleza ngomzuzwana, zihlanganise ulwazi oluvela kuzo zonke izindawo lube yi-console ephakathi, lapho impilo yonke yenethiwekhi iqashwa khona.

Isihluthulelo lapha ukuqinisekisa ukuthi Ihhovisi ngalinye noma indawo ekude ithumela imifudlana yayo yedatha kumqoqi ophakathilapho ulwazi luhlanganiswa khona futhi kukhiqizwa imibiko ehlanganisiwe. Lokhu kuvumela ithimba lokusebenza ukuthi libone ngokushesha ukuthi inkinga yenzeka kuphi ebalazweni, ububanzi bayo, nokuthi yimaphi amadivayisi ahilelekile.

Ngaphezu kwalokho, eziningi zalezi zinkundla zinikeza izinguqulo zamahhala noma izikhathi zokulinga okukuvumela ukuthi uhlole amakhono abo endaweni yangempela yenhlangano ngaphambi kokwenza isinqumo sokuthenga, into ewusizo kakhulu kumanethiwekhi akhula futhi adinga izixazululo ezinwebekayo neziqinile.

Isici esibalulekile ukusekelwa kwamafomethi amaningi okugeleza (i-NetFlow, i-sFlow, i-cflow, i-J-Flow, i-FNF, i-IPFIX, i-NetStream, i-AppFlow, phakathi kwabanye) kanye nokuhambisana nemishini evela kubakhiqizi abahlukahlukene njenge-Cisco, i-Juniper, i-HP, i-Extreme, noma i-3Com, okuvumela hlanganisa ikhambi ezindaweni ezingafani ngaphandle kokuthembela kumhlinzeki oyedwa.

I-Wireshark: indinganiso yangempela yokuhlaziywa kwephakethe

Ezweni lokuhlaziywa kwephrothokholi, iWireshark isibe ithuluzi lokulinganisaEkuqaleni yasungulwa njenge-Ethereal ngasekupheleni kweminyaka yama-90, isishintshe yaba yindinganiso yomhlaba wonke yokubamba, ukuphula, nokuqonda ithrafikhi yenethiwekhi.

Inani elikhulu leWireshark lisekhonweni layo lokwenza Bamba ithrafikhi ngesikhathi sangempela, hlunga ngezinqubo eziningi, bese uhlaziya iphakethe ngalinye ngokujulile.Ibonisa ngokuningiliziwe izendlalelo ezahlukene zemodeli ye-OSI, izihloko zephrothokholi, amakheli e-IP, amachweba futhi, uma kungekho ukubethela, ngisho nokuqukethwe kokuxhumana.

Ukuhambisana kwayo nezinhlelo zokusebenza ezinkulu (iWindows, iLinux, i-macOS) kanye nenani elikhulu lamaphrothokholi asekelwayo kwenza kube lula. ithuluzi elibalulekile kokubili abaphathi benethiwekhi kanye nochwepheshe bezokuphepha kwe-cyberNgaphezu kwalokho, isetshenziswa kakhulu emkhakheni wokuqeqesha ukufundisa ukuthi amaphrothokholi asebenza kanjani nokuthi ukuxhumana phakathi kwezinhlelo kuhlelwa kanjani.

Emisebenzini yokuhlaziya ithrafikhi, iWireshark ivumela ukubona ngeso lengqondo ukuthi amadivayisi axhumana kanjani ngaphakathi kwengqalasizindaIqapha i-bandwidth, ikhomba ukuthi yimaphi ama-node asebenzisa izinsiza eziningi, ilinganise ukubambezeleka phakathi kwamaphuzu, futhi ibone ukuminyana noma imizila engasebenzi kahle. Iwusizo kakhulu futhi ekutholeni ukusetshenziswa kwezinqubo eziphelelwe yisikhathi noma ezingavikelekile (isibonelo, izinguqulo ezindala ze-TLS noma ithrafikhi ye-HTTP engabethelwe) kanye nokusebenzisa izinyathelo zokunciphisa.

Uhlelo lwayo lokuhlunga olunamandla lusiza ekugxiliseni ukuhlaziywa kuphela kuthrafikhi efanele, ukunciphisa umsindo nokusheshisa ukwenziwa kwezinqumo zobuchwephesheLokhu kubalulekile uma usebenza ngamaphakethe amaningi noma ezimweni eziyinkimbinkimbi lapho umzuzwana ngamunye ubalulekile.

Ukuxilongwa, ukwenza ngcono, kanye nokuphepha okuhlaselayo nge-Wireshark

I-Wireshark ikhanya kakhulu ekuxilongeni izinkinga zenethiwekhiKusukela ekuhlulekeni kokuxhumana kuya ekuwohlokeni kokusebenza ngezikhathi ezithile, kanye nokuziphatha okungavamile kohlelo lokusebenza, ithuluzi likuvumela ukuthi ulandelele amaphakethe ukuze uthole ukuthi uchungechunge luphuka kuphi.

Ngalo, umuntu angabona Amaphutha okucushwa kwe-IP (amamaski angalungile, amasango angafinyeleleki)Ukuphazamiseka kweseshini ye-TCP, ukudluliselwa kabusha okukhulu, ukulahleka kwephakethe, noma ukubambezeleka okuphezulu phakathi kwama-hops. Kuphinde kusize ukuqinisekisa ukusebenza okulungile kwezinsizakalo eziyisisekelo ezifana ne-DHCP (ukunikezwa kwekheli), i-DNS (ukulungiswa kwegama), noma i-ARP (ukulungiswa kwekheli le-MAC), ukuthola ukungqubuzana okungenzeka noma izimpendulo ezinephutha.

Ngaphandle kokuxilongwa, i-Wireshark iwusizo kakhulu thuthukisa ukusebenza kwenethiwekhi kanye nohlelo lokusebenzaNgokuhlaziya indlela ukuxhumana kwe-TCP okusungulwa futhi kugcinwa ngayo, ukuthi usayizi wefasitela osetshenziswayo, ukuthi zingaki izidluliseli ezenzekayo, noma ukuthi kuthatha isikhathi esingakanani ukuxhawulana okuthile ukuqeda, kungenzeka ukulungisa amapharamitha okucushwa, ukubeka phambili ithrafikhi usebenzisa i-QoS, noma ngisho nokuklama kabusha ingxenye yokwakheka kohlelo lokusebenza.

Emkhakheni wezokuphepha kwe-inthanethi, i-Wireshark inohlobo oluphindwe kabili: iyithuluzi eliyisisekelo lamaqembu okuzivikela (i-Blue Team) kanye namaqembu okuhlasela (i-Red Team kanye nabahloli bokungena). Ikhono layo loku Ukuthwebula nokuhlaziya ithrafikhi ngesikhathi sangempela kuvumela ochwepheshe bezokuphepha ukuthi babone kahle ukuthi izinhlelo zixhumana kanjani.yiziphi izinqubo ezisebenzayo, yiziphi izinsizakalo ezivezwayo, kanye nalapho kukhona khona ubuthakathaka obungasetshenziswa.

Ama-hacker—ngokuziphatha noma cha—asebenzisa i-Wireshark ukuze ukwenza ukuhogela kumanethiwekhi avulekile noma angabethelwe kahleThwebula iziqinisekiso noma amathokheni eseshini, hlaziya ithrafikhi yewebhu noma yohlelo lokusebenza lweselula, izinhlelo zokusebenza zeminwe kanye nezinsizakalo, bese uqinisekisa ukuthi umthwalo okhokhelwayo ube nomphumela ofiselekayo. Emisebenzini yokuhlola ukungena kobungcweti, isetshenziselwa futhi ukuqinisekisa ukuthi ulwazi lubethelwe ngempela, ukuthi ukuhlukaniswa kwenethiwekhi kusetshenziswe kahle, noma uma kukhona ukuvuza kwedatha okungatholakali.

I-Wireshark iphrojekthi ye Umthombo ovulekile ngaphansi kwelayisensi ye-GNU GPL, mahhala ngokupheleleKodwa-ke, ukuqeqeshwa okukhokhelwayo, ukwesekwa, kanye nezinsizakalo zokubonisana kuye kwavela nxazonke, kuqondiswe ezindaweni zezinkampani ezidinga izinga eliphezulu lokusekelwa. Ukwazi leli thuluzi sekuyinto edingekayo kunoma ubani ofisa ukusebenza ngokungathi sína ekuphathweni kwenethiwekhi noma ekuphepheni okuhlaselayo.

Ukuhlaziywa kwemishini namanethiwekhi, kusukela engqalasizinda ebonakalayo kuya kuthrafikhi enengqondo kanye namagrafu omphakathi, sekuyinto ebalulekile Ukuze kulondolozwe ukuphepha, ukusebenza, kanye nokuqhubeka kwanoma iyiphi inhlangano exhunyiwe, ukuthembela kumathuluzi afanele—kusukela kubahlaziyi behadiwe nesofthiwe kuya kuzixazululo ezigelezayo njenge-NetFlow Analyzer noma abahlaziyi bephakethe njenge-Wireshark—kwenza umehluko phakathi kokusabela ekuhlaselweni komlilo noma ukulindela inkinga ngayinye engase ivele ngedatha eqinile.