Isesengura ryimbitse no Gushyira mu bikorwa Kugereranya TAP na SPAN Urusobe rwumuhanda wo gukusanya amakuru

Mu bijyanye n'imikorere n'imicungire y'imiyoboro, gukemura ibibazo, no gusesengura umutekano, kubona amakuru y'imiyoboro neza kandi neza ni ishingiro ryo gukora imirimo itandukanye. Nk'ikoranabuhanga rikuru ryo kubona amakuru y'imiyoboro, TAP (Test Access Point) na SPAN (Switched Port Analyzer, izwi kandi nka port mirroring) bigira uruhare runini mu bihe bitandukanye bitewe n'imiterere yabyo itandukanye ya tekiniki. Gusobanukirwa byimbitse imiterere yabyo, ibyiza byabyo, imbogamizi zabyo, n'ibihe bifatika ni ingenzi ku bahanga mu by'imiyoboro kugira ngo bashyireho gahunda zo gukusanya amakuru zikwiye no kunoza imikorere myiza y'imiyoboro.

TAP: Igisubizo cyuzuye kandi kigaragara "Gutakaza" Igisubizo cyo gufata Data

TAP nigikoresho cyuma gikora kumubiri cyangwa guhuza amakuru. Igikorwa cyibanze ni ukugera ku 100% kwigana no gufata imiyoboro yamakuru atabangamiye urujya n'uruza rwambere. Muguhuza murukurikirane mumurongo uhuza (urugero, hagati ya switch na seriveri, cyangwa router na switch), irigana paki zose zo hejuru no kumanuka zamakuru zinyura kumurongo uhuza icyambu ukoresheje uburyo "bwo gutandukanya optique" cyangwa "kugabana ibinyabiziga", kugirango bitunganyirizwe hamwe nibikoresho byisesengura (nk'abasesengura imiyoboro hamwe na sisitemu yo kwinjira - IDS).

Ibintu nyamukuru biranga: Bishingiye kuri "Ubunyangamugayo" na "Guhagarara"

1. 100% Ifatwa rya Data Packet Ifite Ntakibazo

Izi ninyungu zigaragara za TAP. Kubera ko TAP ikorera kumurongo wumubiri kandi ikigana mu buryo butaziguye ibimenyetso byamashanyarazi cyangwa optique ihuza, ntabwo yishingikiriza kumikoreshereze ya CPU ya CPU kubikoresho byoherejwe cyangwa byo kwigana. Kubwibyo, utitaye ku kuba urujya n'uruza rwarwo ruri hejuru cyangwa rukaba rufite ibipimo binini binini (nka Jumbo Frames ifite agaciro kanini ka MTU), paki zose zamakuru zirashobora gufatwa rwose nta gutakaza paki zatewe nubushobozi budahagije bwo guhinduranya. Iyi "fata idafite igihombo" ituma iba igisubizo cyatoranijwe kuri ssenariyo isaba inkunga yukuri yamakuru (nkumuzi wibitera intandaro hamwe nisesengura ryibanze ryurusobe).

2. Nta ngaruka ku mikorere y'ibanze y'umuyoboro

Uburyo bwakazi bwa TAP buremeza ko budatera intambamyi kumurongo wambere. Ntabwo ihindura ibirimo, inkomoko / aderesi ya aderesi, cyangwa igihe cyo gupakira amakuru cyangwa ntigifata umwanya wicyambu cya enterineti, cache, cyangwa ibikoresho byo gutunganya. Nubwo igikoresho cya TAP ubwacyo kidakora neza (nko kunanirwa kw'amashanyarazi cyangwa kwangirika kw'ibyuma), bizavamo gusa nta bisohoka bivuye ku cyambu cyo gukurikirana, mu gihe itumanaho ry'umuyoboro wa mbere rihora risanzwe, birinda ibyago byo guhagarika imiyoboro biterwa no kunanirwa kw'ibikoresho byo gukusanya amakuru.

3. Inkunga ya Byuzuye-Duplex Ihuza hamwe nibidukikije bigoye

Imiyoboro igezweho ahanini ifata uburyo bwitumanaho bwuzuye (urugero, amakuru yo hejuru no kumanuka ashobora koherezwa icyarimwe). TAP irashobora gufata amakuru yinzira mubyerekezo byombi byuzuzanya-byuzuye kandi ikabisohora binyuze ku byambu byigenga bikurikirana, byemeza ko igikoresho cyo gusesengura gishobora kugarura byimazeyo inzira zombi zitumanaho. Mubyongeyeho, TAP ishyigikira ibipimo bitandukanye byurusobe (nka 100M, 1G, 10G, 40G, ndetse na 100G) hamwe nubwoko bwitangazamakuru (bigoretse byombi, fibre imwe-fibre, fibre-moderi nyinshi), kandi birashobora guhuzwa nibidukikije byurusobe rwibintu bitandukanye nkibigo byamakuru, imiyoboro yibanze yumugongo, hamwe numuyoboro wikigo.

Ikoreshwa rya Porogaramu: Kwibanda kuri "Isesengura Ryukuri" na "Gukurikirana Ihuza Ryingenzi"

1. Gukemura ibibazo byumuyoboro hamwe nigitera imizi

Mugihe ibibazo nko gutakaza paki, gutinda, jitter, cyangwa gusaba gutinda bibaye murusobe, birakenewe kugarura ibintu mugihe ikosa ryabaye binyuze mumasoko yuzuye yamakuru. Kurugero, niba sisitemu yibanze yubucuruzi (nka ERP na CRM) ifite uburambe bwigihe cyo kubona umwanya, abakozi nogukora neza barashobora kohereza TAP hagati ya seriveri na sisitemu yibanze kugirango bafate paki zose zuruzinduko, gusesengura niba hari ibibazo nka TCP retransmission, gutakaza paki, gutinda kwa DNS gukemura, cyangwa gukemura ibibazo bya progaramu ya progaramu, nkibisubizo byihuse byikibazo, nkibisubizo byibanze byikibazo, nkibisubizo byibanze byikibazo, nkibisubizo byibanze byikibazo,

2. Gushiraho Urusobekerane rwibanze rwimikorere no gukurikirana Anomaly

Mubikorwa byurusobe no kubungabunga, gushiraho imikorere yibanze munsi yubucuruzi busanzwe (nkikigereranyo cyo gukoresha umurongo mugari, gutekera amakuru gutinda gutinda, hamwe nigipimo cyo gutsinda kwa TCP) ni ishingiro ryo gukurikirana ibintu bidasanzwe. TAP irashobora gufata neza amakuru yuzuye yamakuru yingenzi (nko hagati yimikorere yibanze no hagati ya egress ya router na ISP) mugihe kirekire, ifasha imikorere no kubungabunga abakozi kubara ibipimo ngenderwaho bitandukanye no gushyiraho icyitegererezo cyibanze. Iyo ibintu bidasanzwe nyuma yumuvuduko ukabije wumuhanda, gutinda bidasanzwe, cyangwa protocole idasanzwe (nkibisabwa ARP idasanzwe hamwe numubare munini wapaki ya ICMP), anomalies irashobora gutahurwa vuba ugereranije nibyingenzi, kandi birashobora gukorwa mugihe gikwiye.

3. Kugenzura iyubahirizwa no gutahura iterabwoba hamwe nibisabwa byumutekano mwinshi

Ku nganda zifite ibisabwa cyane mu gucunga umutekano no kubahiriza nk’imari, ibibazo bya guverinoma, n’ingufu, birakenewe ko hakorwa igenzura ryuzuye ryerekana uburyo bwo kohereza amakuru yoroheje cyangwa kumenya neza ingaruka zishobora guterwa n’urusobe (nk'ibitero bya APT, kumena amakuru, no gukwirakwiza kode mbi). Ikiranga igihombo cya TAP cyerekana ubunyangamugayo nukuri kwamakuru yubugenzuzi, ashobora kubahiriza ibisabwa n amategeko n'amabwiriza nka "Amategeko y’umutekano w’urusobe" na "Amategeko y’umutekano" kugira ngo abike kandi agenzurwe; icyarimwe, ibipimo byuzuye byamakuru bitanga kandi urugero rwiza rwo gusesengura sisitemu yo gutahura iterabwoba (nka IDS / IPS n'ibikoresho bya sandbox), bifasha gutahura iterabwoba rito kandi ryihishe ryihishe mu muhanda usanzwe (nka code mbi mu ibanga ryihishe hamwe n'ibitero byinjira byihishe nk'ubucuruzi busanzwe).

Imbogamizi: Ihindagurika hagati y'Ikiguzi n'Uburyo bwo Gukoresha Imashini

Inzitizi nyamukuru za TAP ziri mubikoresho byayo byigiciro cyinshi kandi byoroshye kohereza. Ku ruhande rumwe, TAP nigikoresho cyabigenewe cyabugenewe, kandi byumwihariko, TAPs ishyigikira ibiciro biri hejuru (nka 40G na 100G) cyangwa itangazamakuru rya fibre optique ihenze cyane kuruta imikorere ya SPAN ishingiye kuri software; kurundi ruhande, TAP igomba guhuzwa murukurikirane rwumuyoboro wambere, kandi ihuza rigomba guhagarikwa byigihe gito mugihe cyoherejwe (nko gucomeka no gucomeka insinga zumurongo cyangwa fibre optique). Kubihuza bimwe byingenzi bitemerera guhagarika (nkumuhuza wubucuruzi wimari ukora 24/7), kubohereza biragoye, kandi aho TAP igera mubisanzwe igomba kubikwa mbere mugihe cyicyiciro cyo gutegura urusobe.

SPAN: Igiciro-Cyiza kandi cyoroshye "Multi-Port" Igisubizo cyo gukusanya amakuru

SPAN nigikorwa cya software cyubatswe muri switch (bamwe murwego rwohejuru rwo hejuru nabo barabishyigikira). Ihame ryayo nugushiraho icyerekezo imbere kugirango wigane traffic kuva ku cyambu kimwe cyangwa byinshi biva mu isoko (Inkomoko yicyambu) cyangwa isoko VLANs kugera ku cyambu cyabigenewe cyo kugenzura (Icyerekezo cya Port, kizwi kandi nk'icyambu cy'indorerwamo) cyo kwakira no gutunganya hakoreshejwe ibikoresho byo gusesengura. Bitandukanye na TAP, SPAN ntisaba ibikoresho byongeweho byuma kandi irashobora kumenya ikusanyamakuru gusa ishingiye kumiterere ya software ya switch.

Ibintu nyamukuru biranga: Byibanze kuri "Ikiguzi-Cyiza" na "Guhinduka"

1. Zeru Yongeyeho Ibikoresho Byuma hamwe no Kohereza Byoroshye

Kubera ko SPAN ari imikorere yubatswe muri software ikora ibintu, nta mpamvu yo kugura ibikoresho byabigenewe byabugenewe. Ikusanyamakuru rishobora gushobozwa byihuse gusa mugushiraho binyuze muri CLI (Command Line Interface) cyangwa Imiyoboro yo gucunga Urubuga (nko kwerekana icyambu cyaturutse, icyambu cyo kugenzura, hamwe nicyerekezo cyerekana (kwinjira, gusohoka, cyangwa byerekezo)). Iyi "zero yibikoresho bya zeru" ituma ihitamo neza kuri ssenariyo ifite ingengo yimishinga mike cyangwa ibikenewe byo kugenzura by'agateganyo (nko kugerageza igihe gito cyo kugerageza no gukemura ibibazo by'agateganyo).

2. Inkunga ya Multi-Source Port / Multi-VLAN Igiteranyo cyumuhanda

Inyungu nyamukuru ya SPAN ni uko ishobora kwigana traffic kuva ku byambu byinshi (nk'ibyambu by'abakoresha uburyo bwo guhinduranya ibintu byinshi) cyangwa VLAN nyinshi ku cyambu kimwe cyo gukurikirana icyarimwe. Kurugero, niba abakozi bashinzwe ibikorwa no kubungabunga abakozi bakeneye kugenzura urujya n'uruza rw'abakozi mu mashami menshi (ahuye na VLAN zitandukanye) bagera kuri interineti, nta mpamvu yo kohereza ibikoresho bitandukanye byo gukusanya kuri egress ya buri VLAN. Muguhuriza hamwe urujya n'uruza rwa VLANs ku cyambu kimwe cyo kugenzura binyuze muri SPAN, isesengura ryibanze rishobora kugerwaho, bikazamura cyane guhinduka no gukora neza ikusanyamakuru.

3. Ntibikenewe guhagarika umuyoboro wumwimerere

Bitandukanye nuruhererekane rwoherejwe rwa TAP, byombi icyambu cyaturutse hamwe nicyambu cyo kugenzura cya SPAN ni ibyambu bisanzwe bya switch. Mugihe cyibikorwa byo kuboneza, nta mpamvu yo gucomeka no gucomeka insinga zurusobekerane rwumwimerere, kandi nta ngaruka zigira ku ihererekanyabubasha ryambere. Nubwo ari ngombwa guhindura inkomoko yinkomoko cyangwa guhagarika imikorere ya SPAN nyuma, birashobora gukorwa gusa muguhindura iboneza binyuze kumurongo wategeka, byoroshye gukora kandi nta nkomyi na serivise zurusobe.

Ikoreshwa rya Porogaramu: Kwibanda kuri "Kugenzura Ibiciro Bito" na "Isesengura Ryibanze"

1. Gukurikirana Imyitwarire Yabakoresha Mumurongo Wikigo / Imishinga Yumushinga

Mu miyoboro y’ikigo cyangwa imiyoboro y’ibigo, abayobozi akenshi bakeneye kugenzura niba amaherere y’abakozi afite uburenganzira butemewe (nko kugera ku mbuga za interineti zitemewe no gukuramo porogaramu za pirate) kandi niba hari umubare munini wo gukuramo P2P cyangwa amashusho yerekana amashusho afite umurongo mugari. Muguhuriza hamwe urujya n'uruza rw'ibyambu byifashishwa byinjira-byinjira ku cyambu cyo kugenzura binyuze muri SPAN, hamwe na porogaramu yo gusesengura ibinyabiziga (nka Wireshark na NetFlow Analyser), kugenzura igihe nyacyo ku myitwarire y'abakoresha n'imibare y’umurongo wa interineti bishobora kugerwaho nta shoramari ry’ibyuma byiyongereye.

2. Gukemura ibibazo by'agateganyo no kugerageza igihe gito

Iyo amakosa yigihe gito kandi rimwe na rimwe agaragaye murusobe, cyangwa mugihe bibaye ngombwa gukora ibizamini byumuhanda kuri porogaramu nshya yoherejwe (nka sisitemu ya OA y'imbere hamwe na sisitemu yo guterana amashusho), SPAN irashobora gukoreshwa mukubaka byihuse gukusanya amakuru. Kurugero, niba ishami rivuga ko ubukonje bukunze kugaragara mubiganiro bya videwo, abakozi bashinzwe kubungabunga no kubungabunga barashobora gushiraho by'agateganyo SPAN kugirango berekane urujya n'uruza rw'icyambu aho seriveri ya videwo iherereye ku cyambu gikurikirana. Mugusesengura amakuru yatinze gutinda, igipimo cyo gutakaza paki, hamwe nakazi ka bande, birashobora kumenya niba ikosa ryatewe numuyoboro udahagije wumuyoboro cyangwa gutakaza amakuru. Nyuma yo gukemura ibibazo birangiye, iboneza rya SPAN rirashobora guhagarikwa bitagize ingaruka kumikorere ikurikira.

3. Imibare yumuhanda hamwe nubugenzuzi bworoshye mumiyoboro mito n'iciriritse

Ku miyoboro mito n'iciriritse (nk'ibigo bito na laboratoire zo mu kigo), niba ibisabwa kugira ngo ikusanyirizo ry'amakuru ridahagije, kandi gusa imibare yoroheje yo mu muhanda (nko gukoresha umurongo wa interineti kuri buri cyambu no kugereranya ibinyabiziga bya Top N) cyangwa igenzura ryibanze ryubahirizwa (nko kwandika amazina y'urubuga rwinjira ku bakoresha), SPAN irashobora guhaza ibikenewe byose. Ibiciro byayo bihendutse kandi byoroshye-kubohereza ibintu bituma ihitamo ikiguzi kubintu nkibi.

Imipaka: Ibitagenda neza muburyo bwamakuru hamwe ningaruka zikorwa

1. Ingaruka zo Gutakaza Data Packet Gutakaza no Gufata Byuzuye

Kwigana amakuru yamapaki ya SPAN yishingikiriza kuri CPU na cache umutungo wa switch. Iyo urujya n'uruza rw'icyambu ruri hejuru cyane (nko kurenza ubushobozi bwa cache ubushobozi bwa cache) cyangwa uhindura arimo gutunganya umubare munini wimirimo yohereza icyarimwe, CPU izashyira imbere kwemeza kohereza ibinyabiziga byambere, kandi bigabanye cyangwa bihagarike kwigana ibinyabiziga bya SPAN, bikaviramo gutakaza paki ku cyambu gikurikirana. Mubyongeyeho, abahindura bamwe bafite imbogamizi ku kigereranyo cyerekana indorerwamo ya SPAN (nko gushyigikira gusa kwigana 80% byimodoka) cyangwa ntibashyigikire byuzuye kwigana ibipimo binini binini (nka Jumbo Frames). Ibi byose bizaganisha kumakuru atuzuye kandi bigira ingaruka kumyizerere yisesengura ryakurikiyeho.

2. Kwigarurira ibikoresho byo guhindura hamwe ningaruka zishobora kubaho kumikorere ya Network

Nubwo SPAN idahagarika mu buryo butaziguye ihuza ryumwimerere, mugihe umubare wibyambu bituruka ari munini cyangwa urujya n'uruza rwinshi, inzira yo kwigana data packet izaba ifite ibikoresho bya CPU hamwe numuyoboro mugari wa switch. Kurugero, niba urujya n'uruza rw'ibyambu byinshi 10G rwerekanwe ku cyambu cya 10G cyo kugenzura, mugihe urujya n'uruza rw'ibyambu bituruka hejuru ya 10G, ntabwo icyambu cyo kugenzura kizagira ikibazo cyo gutakaza paki bitewe n'umuyoboro udahagije, ariko gukoresha imikoreshereze ya CPU bishobora no kwiyongera ku buryo bugaragara, bityo bikagira ingaruka ku mikorere rusange yo guhinduranya.

3. Imikorere Yishingikirije kuri Guhindura Model no Guhuza Buke

Urwego rwo gushyigikira imikorere ya SPAN ruratandukanye cyane muburyo bwo guhinduranya ibicuruzwa bitandukanye na moderi. Kurugero, abahindura buke-buke barashobora gusa gushyigikira icyambu kimwe cyo kugenzura kandi ntibashyigikira indorerwamo ya VLAN cyangwa indorerwamo yuzuye-duplex; imikorere ya SPAN ya bamwe bahinduranya ifite "inzira imwe yerekana indorerwamo" (ni ukuvuga gusa indorerwamo yinjira cyangwa isohoka, kandi ntishobora kwerekana indorerwamo zibiri icyarimwe); hiyongereyeho, kwambukiranya SPAN (nko kwerekana urujya n'uruza rw'icyambu A ujya ku cyambu cyo kugenzura B) bigomba kwishingikiriza kuri protocole yihariye (nka RSPAN ya Cisco na ERSPAN ya Huawei), ifite imiterere igoye kandi idahuye neza, kandi biragoye guhuza n'ibidukikije bivanze no guhuza imiyoboro myinshi y'abakora ibicuruzwa byinshi.

Itandukaniro Ryingenzi Kugereranya no Guhitamo Ibyifuzo hagati ya TAP na SPAN

Kugereranya Ibyingenzi

Kugirango turusheho kwerekana itandukaniro riri hagati yibi byombi, turabigereranya duhereye ku bipimo biranga tekiniki, ingaruka zikorwa, igiciro, hamwe nibisabwa:

Ibyifuzo byo Guhitamo: "Guhuza Nukuri" Ukurikije Ibisabwa

1. Ibintu aho TAP ikundwa

○Gukurikirana ibikorwa byingenzi byubucuruzi (nkamakuru yamakuru yibanze ya sisitemu na egress ya router ihuza), bisaba kwemeza ubusugire bwo gufata amakuru;

○Umuyoboro w'amakosa umuzi utera ahantu (nka TCP retransmission na progaramu ya lag), bisaba isesengura ryukuri rishingiye kububiko bwuzuye bwuzuye;

○Inganda zifite umutekano muke kandi zisabwa (imari, ibibazo bya leta, ingufu), bisaba kubahiriza ubunyangamugayo no kutabangamira amakuru yubugenzuzi;

○Ibidukikije byihuta cyane (10G no hejuru) cyangwa ibintu bifite ibipimo binini binini, bisaba kwirinda gutakaza paki muri SPAN.

2. Scenarios Aho SPAN ikunzwe

○Imiyoboro mito n'iciriritse ifite ingengo yimishinga mike, cyangwa ibintu bisaba gusa imibare yoroheje yumuhanda (nkumurimo wogukora hamwe na Top Top);

○Gukemura ibibazo by'agateganyo cyangwa kugerageza igihe gito cyo gusaba (nk'ibizamini bishya byo gutangiza sisitemu), bisaba koherezwa byihuse nta mutungo w'igihe kirekire ukora;

○Gukurikirana hagati yibyambu byinshi / byinshi-VLANs (nko kugenzura imyitwarire yumukoresha wikigo), bisaba guhuza ibinyabiziga byoroshye;

○Kugenzura imiyoboro idafite ishingiro (nkibyambu byabakoresha byinjira-byahinduwe), hamwe nibisabwa bike kugirango amakuru afatwe neza.

3. Ikoreshwa rya Hybrid

Mubice bimwe bigoye byurusobe rwibidukikije, uburyo bwo kohereza "TAP + SPAN" nabwo bushobora gukoreshwa. Kurugero, koresha TAP mumurongo wibanze wikigo cyamakuru kugirango umenye neza amakuru yuzuye kugirango ukemure ibibazo hamwe nubugenzuzi bwumutekano; Kugena SPAN muburyo bwo kugera-cyangwa guteranya-guhinduranya kugirango ukusanyirize hamwe urujya n'uruza rw'abakoresha kugirango basesengure imyitwarire hamwe n'imibare yagutse. Ibi ntabwo bihuye gusa nuburyo bukenewe bwo gukurikirana imiyoboro yingenzi ahubwo binagabanya ikiguzi cyoherejwe muri rusange.

Rero, nk'ikoranabuhanga ry'ingenzi rikoreshwa mu gushaka amakuru kuri interineti, TAP na SPAN nta "byiza cyangwa ibibi" bifite ahubwo ni "itandukaniro mu guhindura ibintu". TAP ishingiye ku "gufata amakuru nta gihombo" na "kwizerwa guhamye", kandi ikwiriye ibintu by'ingenzi bifite ibisabwa byinshi kugira ngo amakuru abe meza kandi adahungabana, ariko ihenze cyane kandi idafite ubushobozi bwo kuyakoresha; SPAN ifite ibyiza bya "zero cost" na "flexible and comfortable", kandi ikwiriye ibintu bihendutse, by'igihe gito, cyangwa bitari iby'ingenzi, ariko ifite ibyago byo gutakaza amakuru n'ingaruka ku mikorere.

Mubikorwa byukuri byurusobe no kubungabunga, abashinzwe imiyoboro bakeneye guhitamo igisubizo kiboneye gikwiye bashingiye kubyo bakeneye bakeneye (nko kumenya niba ari ihuriro ryibanze kandi niba hakenewe isesengura ryukuri), ikiguzi cyingengo yimari, igipimo cyurusobe, nibisabwa kubahiriza. Muri icyo gihe, hamwe no kuzamura igipimo cy’urusobe (nka 25G, 100G, na 400G) hamwe no kuzamura ibisabwa by’umutekano w’urusobe, ikoranabuhanga rya TAP naryo rihora ritera imbere (nko gushyigikira igabanywa ry’imodoka rigabanywa hamwe no guhuza ibyambu byinshi), kandi n’abakora ibicuruzwa na bo bahora batezimbere imikorere ya SPAN (nko kuzamura ubushobozi bwa cache no gushyigikira indorerwamo zitagira igihombo). Mu bihe biri imbere, tekinoloji zombi zizakomeza gukina inshingano zazo murwego rwazo kandi zitange amakuru meza kandi yukuri yo gucunga imiyoboro.