Kuongororwa kwakadzama uye Kuenzanisa Mashandisirwo eTAP neSPAN Network Traffic Data Acquisition Methods

Muminda yekushanda nekugadzirisa network, kugadzirisa matambudziko, uye kuongorora kuchengetedzeka, kuwana data re network nenzira kwayo uye zvinobudirira ndiyo hwaro hwekuita mabasa akasiyana-siyana. Sezvo matekinoroji maviri makuru ekuwana data re network, TAP (Test Access Point) neSPAN (Switched Port Analyzer, inowanzonziwo port mirroring) anoita mabasa akakosha mumamiriro akasiyana-siyana nekuda kwehunhu hwawo hwakasiyana hwehunyanzvi. Kunzwisisa kwakadzama kwehunhu hwavo, zvakanakira, zvipingamupinyi, uye mamiriro anoshanda kwakakosha kuti mainjiniya e network vagadzire hurongwa hwekuunganidza data hwakakodzera uye kuvandudza mashandiro e network.

TAP: Mhinduro Yakakwana uye Inooneka Yekutora Data "Isina Kurasikirwa"

TAP mudziyo wehardware unoshanda pachikamu che physical kana data link. Basa rayo guru nderekuwana 100% replication uye capture ye network data streams pasina kukanganisa network traffic yekutanga. Nekubatanidzwa mu network link (semuenzaniso, pakati pe switch ne server, kana router ne switch), inodzokorora data rese re upperstream ne downstream richipfuura nepa link kuenda ku monitoring port ichishandisa "optical splitting" kana "traffic splitting", kuti ishandiswe ne analysis devices (senge network analyzers ne Intrusion Detection Systems - IDS).

Zvinhu Zvikuru: Zvakatarisana ne "Kuvimbika" uye "Kugadzikana"

1. Kubata Data Packet 100% Pasina Njodzi Yekurasikirwa

Iyi ndiyo mukana mukuru weTAP. Sezvo TAP ichishanda pachikamu chemuviri uye ichitevedzera zvakananga masaini emagetsi kana emaziso ari mu link, haivimbi nezviwanikwa zveCPU zve switch kuti data packet itumirwe kana kudzokororwa. Saka, zvisinei nekuti network traffic iri padanho rayo repamusoro here kana kuti ine data packets hombe (senge Jumbo Frames ine MTU value yakakura), data packets dzese dzinogona kutorwa zvachose pasina kurasikirwa kwepackets kunokonzerwa nekusakwana kwe switch resources. Iyi "lossless capture" inoita kuti ive mhinduro inosarudzwa kune zviitiko zvinoda rutsigiro rwedata rwakarurama (senge fault root cause location uye network performance baseline analysis).

2. Hapana Chinokanganisika Pakushanda Kwepakutanga Kwenetwork

Maitiro ekushanda eTAP anoita kuti isakanganise network link yekutanga. Haigadzirise zviri mukati, maadhiresi ekunobva/kwainoenda, kana nguva yemapaketi edata kana kutora bandwidth yechiteshi cheswitch, cache, kana zviwanikwa zvekugadzirisa. Kunyangwe mudziyo weTAP pachawo ukatadza kushanda zvakanaka (sekukundikana kwemagetsi kana kukuvara kwehardware), hazvizongogumiri pakubuda kwedata kubva pachiteshi chekutarisa, nepo kutaurirana kwe network link yekutanga kuchiramba kwakajairika, zvichidzivirira njodzi yekukanganiswa kwe network kunokonzerwa nekukundikana kwemidziyo yekuunganidza data.

3. Rutsigiro rweFull-Duplex Links uye Nzvimbo Dzakaoma dzeNetwork

Manetwork emazuva ano anowanzoshandisa nzira yekutaurirana yakazara-duplex (kureva kuti, data rekumusoro nerekumashure rinogona kutapurirwa panguva imwe chete). TAP inogona kubata mastreams edata kumativi ese e-full-duplex link uye kuaburitsa kuburikidza nemaports ekutarisa akazvimiririra, zvichiita kuti mudziyo wekuongorora ugone kudzoreredza zvizere maitiro ekutaurirana maviri. Pamusoro pezvo, TAP inotsigira akasiyana-siyana network rates (akadai se100M, 1G, 10G, 40G, uye kunyange 100G) uye mhando dze media (twisted pair, single-mode fiber, multi-mode fiber), uye inogona kugadziriswa kune network environments dzine kuoma kwakasiyana senge data centers, core backbone networks, uye campus networks.

Maitiro Ekushandisa: Kutarisa pa "Kuongorora Kwakarurama" uye "Kutarisa Key Link"

1. Kugadzirisa Matambudziko eNetwork uye Nzvimbo yeChikonzero Chekutanga

Kana matambudziko akadai sekurasikirwa nemapaketi, kunonoka, kushamisika, kana kunonoka kwekushandisa zvikaitika munetwork, zvakakosha kugadzirisa mamiriro ezvinhu apo kukanganisa kwakaitika kuburikidza neruzivo rwakakwana rwepaketi yedata. Semuenzaniso, kana masisitimu makuru ebhizinesi rebhizinesi (senge ERP neCRM) akawana nguva yekubuda kweinternet, vashandi vekushanda nekugadzirisa vanogona kuisa TAP pakati peseva ne core switch kuti vatore mapaketi ese edata ekudzoka, kuongorora kana paine matambudziko akadai seTCP retransmission, kurasikirwa nemapaketi, kunonoka kwekugadzirisa DNS, kana zvikanganiso zve application-layer protocol, uye nekudaro nekukurumidza kuwana chikonzero chekutadza (senge matambudziko emhando yelink, slow server response, kana middleware configuration errors).

2. Kugadzwa kweNetwork Performance Baseline uye Kutarisa Zvisina Kunaka

Mukushanda nekugadzirisa network, kugadzira baseline yekushanda pasi pemitoro yebhizinesi yakajairika (senge avhareji yekushandiswa kwebandwidth, kunonoka kwedata packet, uye chiyero chekubudirira kweTCP connection) ndiyo hwaro hwekutarisa zvinokanganisika. TAP inogona kubata data rakazara rema key links (senge pakati pema core switches uye pakati pe egress routers ne ISPs) kwenguva yakareba, ichibatsira vashandi vekushanda nekugadzirisa kuverenga zviratidzo zvakasiyana-siyana zvekushanda uye kugadzira baseline model chaiyo. Kana zvinokanganisika zvinotevera zvakaita sekukwira kwetraffic kamwe kamwe, kunonoka kusingawanzoitiki, kana protocol anomalies (senge zvikumbiro zveARP zvisina kujairika uye huwandu hwakawanda hwe ICMP packets) zvikaitika, zvinokanganisika zvinogona kuonekwa nekukurumidza nekuenzanisa ne baseline, uye kupindira panguva yakakodzera kunogona kuitwa.

3. Kuongorora Kutevedza Mutemo uye Kuona Zvinetso Zvine Zvinodiwa Zvekuchengetedza Zvakanyanya

Kune maindasitiri ane zvinodiwa zvepamusoro zvekuchengetedzwa kwedata uye kutevedzera mitemo zvakaita semari, nyaya dzehurumende, uye simba, zvakakosha kuita ongororo yakazara yemafambiro ekutumira data rakavanzika kana kuona nemazvo njodzi dzinogona kuitika pa network (senge kurwiswa kweAPT, kuburitswa kwedata, uye kuparadzirwa kwekodhi yakaipa). Hunhu hwekubata pasina kurasikirwa hweTAP hunovimbisa kuvimbika uye kururama kwedata rekuongorora, izvo zvinogona kusangana nezvinodiwa nemitemo nemirau senge "Network Security Law" ne "Data Security Law" yekuchengetedza nekuongorora data; panguva imwe chete, mapaketi edata akazara anopawo mienzaniso yakawanda yekuongorora masisitimu ekuona njodzi (senge IDS/IPS nemidziyo yesandbox), zvichibatsira kuona njodzi dzisingawanzoitiki uye dzakavanzwa dzakavanzwa mutraffic yakajairika (senge kodhi yakaipa mutraffic yakavharirwa uye kurwiswa kwekupinda kwakavanzika sebhizinesi rakajairika).

Zvipingamupinyi: Kuchinjana pakati peKuchinja kweMari neKushandiswa

Zvipingamupinyi zvikuru zveTAP zviri mumutengo wayo wepamusoro wehardware uye kuchinjika kwakaderera kwekushandisa. Kune rumwe rutivi, TAP mudziyo wehardware wakatsaurirwa, uye kunyanya, maTAP anotsigira mitengo yakakwira (senge 40G ne100G) kana optical fiber media anodhura zvakanyanya kupfuura software-based SPAN function; kune rumwe rutivi, TAP inofanirwa kubatanidzwa mumutsara mu network link yekutanga, uye link inofanira kukanganiswa kwenguva pfupi panguva yekuisa (senge plugging uye unplugging network cables kana optical fibers). Kune mamwe ma core link asingabvumire kukanganiswa (senge ma financial transaction links anoshanda maawa makumi maviri nemana pazuva, mazuva manomwe pasvondo), kuisa kwakaoma, uye TAP access points dzinowanzo fanirwa kuchengetwa pachine nguva panguva yekuronga network.

SPAN: Mhinduro ye "Multi-Port" yekuunganidza data inoshanda uye inochinjika

SPAN ibasa resoftware rakavakirwa mumaswichi (mamwe ma router emhando yepamusoro anoritsigirawo). Chinangwa chayo ndechekugadzirisa switch mukati kuti idzokorore traffic kubva kune imwe kana kupfuura ma source ports (Source Ports) kana kuti maVLAN ekutsvaga kuenda kune yakatarwa monitoring port (Destination Port, inozivikanwawo semirror port) kuti igamuchirwe uye igadziriswe ne analysis device. Kusiyana neTAP, SPAN haidi mamwe mahardware devices uye inogona kuita kuti data riunganidzwe chete nekushandisa software configuration yeswitch.

Zvinhu Zvikuru: Zvakatarisana ne "Kushanda Kwemari" uye "Kuchinjika"

1. Hapana Mari Yekuwedzera yeHardware uye Kutumirwa Kwakanaka

Sezvo SPAN iri basa rakavakirwa mu switch firmware, hapana chikonzero chekutenga zvishandiso zvehardware zvakatsaurirwa. Kuunganidzwa kwedata kunogona kugoneswa nekukurumidza chete nekugadzirisa kuburikidza neCLI (Command Line Interface) kana Web management interface (senge kutsanangura source port, monitoring port, uye mirroring direction (inbound, outbound, kana bidirectional)). Iyi "zero hardware cost" inoita kuti ive sarudzo yakakodzera kune zviitiko zvine bhajeti shoma kana zvinodiwa zvekutarisa kwenguva pfupi (senge kuyedzwa kweapplication kwenguva pfupi uye kugadzirisa matambudziko kwenguva pfupi).

2. Rutsigiro rweMulti-Source Port / Multi-VLAN Traffic Aggregation

Chinhu chikuru cheSPAN ndechekuti inogona kutevedzera traffic kubva kuma source ports akawanda (akadai se user ports ane multiple access-layer switches) kana ma VLAN akawanda kuenda ku monitoring port imwe chete panguva imwe chete. Semuenzaniso, kana vashandi vebhizinesi rekushanda nekugadzirisa vachida kutarisa traffic yevashandi muma terminals akawanda (anoenderana nema VLAN akasiyana) vachishandisa Internet, hapana chikonzero chekuisa michina yakasiyana yekuunganidza pakubuda kweVLAN yega yega. Nekubatanidza traffic yeVLAN idzi kune imwe monitoring port kuburikidza neSPAN, centralized analysis inogona kuwanikwa, zvichivandudza zvikuru kuchinjika uye kushanda zvakanaka kwekuunganidza data.

3. Hapana chikonzero chekukanganisa Network Link yekutanga

Kusiyana nekushandiswa kweTAP, zvese chiteshi chepakutanga uye chiteshi chekutarisa cheSPAN zviteshi zvakajairika zveswitch. Munguva yekugadzirisa, hapana chikonzero chekubatanidza nekuburitsa tambo dzenetwork dzechinongedzo chekutanga, uye hapana chinokanganisa kutapurirana kwetraffic yekutanga. Kunyangwe zvichidikanwa kugadzirisa chiteshi chepakutanga kana kudzima basa reSPAN gare gare, zvinogona kuitwa chete nekugadzirisa configuration kuburikidza nemutsetse wemirairo, iyo iri nyore kushandisa uye isina kukanganiswa nemasevhisi enetwork.

Maitiro Ekushandisa: Kutarisa pa "Kutarisa Kwemutengo Wakaderera" uye "Kuongorora Kwakarongwa"

1. Kutarisa Maitiro Evashandisi muManetiweki eCampus / Enterprise Networks

Muma network epa campaign kana enterprise networks, vatungamiri vanowanzo fanirwa kutarisa kana ma terminal evashandi aine mukana wekupinda zvisiri pamutemo (sekupinda mawebsite asiri pamutemo uye kudhawunirodha software yakabiwa) uye kana paine huwandu hwakawanda hwema downloads eP2P kana mavhidhiyo ari kutora bandwidth. Nekuunganidza traffic yema user ports e access-layer switches kuenda ku monitoring port kuburikidza neSPAN, pamwe chete ne traffic analysis software (yakadai seWireshark neNetFlow Analyzer), real-time monitoring ye user behaviour uye statistics ye bandwidth occupancy inogona kuwanikwa pasina kuwedzera mari ye hardware.

2. Kugadzirisa Matambudziko Kwenguva Pfupi uye Kuedzwa Kwekushandisa Kwenguva Pfupi

Kana paine zvikanganiso zvenguva pfupi uye dzimwe nguva mu network, kana kuti pazvinenge zvichidikanwa kuita bvunzo dze traffic pane application itsva (senge system yeOA yemukati uye system yevideo conferencing), SPAN inogona kushandiswa nekukurumidza kuvaka nzvimbo yekuunganidza data. Semuenzaniso, kana dhipatimendi rikashuma kumisa kwedata kakawanda mu video conferences, vashandi ve operation ne repair vanogona kugadzirisa SPAN kwenguva pfupi kuti iratidze traffic ye port uko video conference server iri kune monitoring port. Nekuongorora kunonoka kwe data packet, packet loss rate, uye bandwidth occupancy, zvinogona kuonekwa kana zvikanganiso zvichikonzerwa ne network bandwidth isina kukwana kana data packet loss. Mushure mekunge kugadzirisa kwapera, SPAN configuration inogona kudzimwa pasina kukanganisa mashandiro e network anotevera.

3. Nhamba dzeTraffic uye Kuongororwa Kuri Nyore muNetwork Diki nepakati

Kune network diki nepakati (dzakadai semabhizinesi madiki nemalaboratori epakoreji), kana chinodiwa chekuunganidza data chisina kukwira, uye nhamba dziri nyore dzetraffic chete (dzakadai sekushandiswa kwebandwidth yechiteshi chimwe nechimwe uye chikamu chetraffic cheTop N applications) kana kuongorora kwekutevedzera mitemo (senge kunyora mazita emadomain ewebhusaiti anowanikwa nevashandisi) zvichidikanwa, SPAN inogona kusangana zvizere nezvinodiwa. Maficha ayo asingadhuri uye ari nyore kuisa anoita kuti ive sarudzo inoshanda pamutengo wezvinhu zvakadaro.

Zvipingamupinyi: Zvikanganiso muKuvimbika kweData uye Kukanganisa Kwekushanda

1. Njodzi Yekurasika Kwepaketi Yedata Uye Kubatwa Kusina Kukwana

Kudzokororwa kwemapaketi edata neSPAN kunoenderana neCPU uye zviwanikwa zvecache zveswitch. Kana traffic yesource port iri padanho rayo guru (senge kupfuura cache capacity yeswitch) kana switch iri kugadzirisa mabasa akawanda ekutumira panguva imwe chete, CPU ichapa mukana wekuona kuti traffic yekutanga yaendeswa mberi, uye kuderedza kana kumisa kudzokororwa kweSPAN traffic, zvichikonzera kurasikirwa kwemapaketi pamonitoring port. Pamusoro pezvo, mamwe maswitch ane zvirambidzo pamirroring ratio yeSPAN (senge kutsigira kudzokororwa kwe80% yetraffic chete) kana kuti haatsigire kudzokororwa kwakazara kwemapaketi makuru edata (senge Jumbo Frames). Zvese izvi zvinotungamira kudata rakaunganidzwa risina kukwana uye zvinokanganisa kururama kwemhedzisiro yekuongorora inotevera.

2. Kushandisa Zvishandiso zveSwitch uye Kukanganisa Kunogona Kuitika paKushanda kweNetwork

Kunyangwe SPAN isingakanganise zvakananga chinongedzo chekutanga, kana huwandu hwema source ports hwakakura kana kuti traffic yakawanda, maitiro ekukopa data packets achatora zviwanikwa zveCPU uye bandwidth yemukati yeswitch. Semuenzaniso, kana traffic yema 10G ports akawanda ichienzaniswa ne 10G monitoring port, kana traffic yese yema source ports ikadarika 10G, kwete chete kuti monitoring port icharasikirwa nemapaketi nekuda kwe bandwidth isina kukwana, asi kushandiswa kweCPU kweswitch kunogonawo kuwedzera zvakanyanya, nokudaro zvichikanganisa mashandiro e data packet forwarding emamwe ma ports uye zvichitokonzera kudzikira kwekushanda kwe switch yese.

3. Kuvimba neMuenzaniso weSwitch uye Kuenderana Kushoma

Hunhu hwekutsigira basa reSPAN hunosiyana zvikuru pakati pemaswitch evagadziri nemamodheru akasiyana. Semuenzaniso, maswitch emhando yepasi anogona kungotsigira chiteshi chimwe chete chekutarisa uye haatsigire VLAN mirroring kana full-duplex traffic mirroring; basa reSPAN remamwe maswitch rine "one-way mirroring" remiganhu (kureva, kungoratidza traffic inopinda kana kubuda chete, uye haigone kuratidza traffic yedivi rimwe chete panguva imwe chete); pamusoro pezvo, cross-switch SPAN (yakadai sekutarisa traffic yechiteshi cheswitch A kuenda kuchiteshi chekutarisa cheswitch B) inoda kuvimba nemaprotocol chaiwo (akadai seCisco's RSPAN neHuawei's ERSPAN), ine magadzirirwo akaomarara uye inoenderana zvishoma, uye yakaoma kugadzirisa zvinoenderana nemamiriro enetwork yakasanganiswa yevagadziri vakawanda.

Kuenzanisa Musiyano Mukuru uye Mazano Ekusarudza Pakati peTAP neSPAN

Kuenzanisa Musiyano Mukuru

Kuti tinyatsoratidza musiyano uripo pakati pezviviri izvi, tinozvienzanisa kubva pahukuru hwehunhu hwehunyanzvi, simba rekushanda, mutengo, uye mamiriro ezvinhu anoshanda:

Mazano Ekusarudza: "Kufananidza Kwakarurama" Zvichibva Pazvinodiwa Nemamiriro Ezvinhu

1. Mamiriro ezvinhu apo TAP inosarudzwa

○Kutarisa ma core business links (akadai se data center core switches uye egress router links), zvichidikanwa kuve nechokwadi chekuti data capture yakavimbika;

○Nzvimbo yenetwork fault cause (yakadai seTCP retransmission uye application lag), inoda kuongororwa kwakarurama zvichibva pamapaketi edata akazara;

○Maindasitiri ane zvinodiwa zvakanyanya zvekuchengetedza uye kutevedzera mitemo (zvemari, nyaya dzehurumende, simba), anoda kusangana nekuvimbika uye kusakanganiswa kwedata rekuongorora;

○Nzvimbo dze network dzinodhura zvakanyanya (10G zvichikwira) kana mamiriro ezvinhu ane mapaketi makuru edata, zvichida kudzivirira kurasikirwa nemapaketi muSPAN.

2. Mamiriro ezvinhu apo SPAN inosarudzwa

○Manetwork madiki nepakati ane bhajeti shoma, kana zviitiko zvinoda nhamba dziri nyore dzetraffic (dzakadai sebandwidth occupation uye Top applications);

○Kugadzirisa matambudziko kwenguva pfupi kana kuyedzwa kwenguva pfupi kwekushandisa (senge kuyedzwa kwekutanga kwesystem itsva), kunoda kuti zvinhu zviitwe nekukurumidza pasina kugara kwenguva refu;

○Kuongororwa kwenzvimbo dzakasiyana-siyana dzemaports/maVLAN akawanda (sekuongororwa kwemaitiro evashandisi vekambasi), kunoda kuunganidzwa kwetraffic kunochinjika;

○Kuongororwa kwezvinobatanidza zvisiri zvepakati (zvakadai semaports evashandisi vemaswichi ekupinda-mukati), pasina zvinodiwa zvakanyanya zvekuchengetedza data.

3. Maitiro Ekushandisa Akasanganiswa

Mune dzimwe nzvimbo dzakaoma dzenetwork, nzira ye "TAP + SPAN" inogona kushandiswawo. Semuenzaniso, isa TAP muma core link edata center kuti uve nechokwadi chekuti data rakazara rinotorwa kuti rigadziriswe nekugadzirisa matambudziko uye kuchengetedzeka; gadzira SPAN muma switch e access-layer kana aggregation-layer kuti uunganidze traffic yevashandisi vakapararira kuti vaongorore maitiro uye nhamba dzebandwidth. Izvi hazvingogumiri pakuzadzisa zvinodiwa zvekutarisa ma key link chete asiwo zvinoderedza mutengo wekutumira.

Saka, sematekinoroji maviri makuru ekuwana data re network, TAP neSPAN hazvina "zvakanakira kana zvakaipa" asi "musiyano mukugadzirisa mamiriro ezvinhu". TAP yakatarisana ne "kutorwa pasina kurasikirwa" uye "kuvimbika kwakagadzikana", uye yakakodzera mamiriro ezvinhu akakosha ane zvinodiwa zvakanyanya zvekuchengetedza data uye kugadzikana kwe network, asi ine mutengo wakakwira uye kuchinjika kwakaderera kwekutumira; SPAN ine zvakanakira zve "zero cost" uye "flexibility uye nyore", uye yakakodzera kune zviitiko zvakachipa, zvechinguvana, kana zvisiri zvepakati, asi ine njodzi dzekurasikirwa nedata uye kukanganisa mashandiro.

Mukushanda nekugadzirisa network chaiyo, mainjiniya enetwork anofanirwa kusarudza mhinduro yehunyanzvi yakakodzera zvichienderana nezvinodiwa nebhizinesi ravo (sekuti inyaya yekubatanidza here uye kana kuongorora kwakarurama kuchidikanwa), mari yebhajeti, chiyero chenetwork, uye zvinodiwa zvekutevedzera mitemo. Panguva imwe chete, nekuvandudzwa kwemitengo yenetwork (senge 25G, 100G, uye 400G) uye kuvandudzwa kwezvinodiwa zvekuchengetedza network, tekinoroji yeTAP iri kuramba ichikura (sekutsigira kupatsanurana kwetraffic kwakangwara uye kuunganidzwa kwemaport akawanda), uye vagadziri veswitch vari kuramba vachigadzirisa basa reSPAN (sekuvandudza kugona kwecache uye kutsigira mirroring isina kurasikirwa). Mune ramangwana, matekinoroji maviri aya acharamba achiita mabasa awo muminda yawo uye kupa rutsigiro rwedata rwakanaka uye rwakarurama rwekutarisira network.