Ni irihe tandukaniro riri hagati ya NetFlow na IPFIX yo gukurikirana imiyoboro ya Network?

NetFlow na IPFIX byombi ni tekinoroji ikoreshwa mugukurikirana imiyoboro no gusesengura. Zitanga ubushishozi muburyo bwimodoka, zifasha mugutezimbere imikorere, gukemura ibibazo, no gusesengura umutekano.

NetFlow:

NetFlow ni iki?

NetFlownigisubizo cyumwimerere cyo kugenzura igisubizo, cyakozwe mbere na Cisco mumpera za 90. Impapuro nyinshi zitandukanye zirahari, ariko ibyinshi byoherejwe bishingiye kuri NetFlow v5 cyangwa NetFlow v9. Mugihe buri verisiyo ifite ubushobozi butandukanye, ibikorwa byibanze bikomeza kuba bimwe:

Ubwa mbere, router, hindura, firewall, cyangwa ubundi bwoko bwibikoresho bizajya bifata amakuru kumurongo "utemba" - mubyukuri urutonde rwibipaki bisangiye ibintu bimwe biranga ibintu nkomoko na aderesi ya aderesi, isoko, hamwe nicyambu, hamwe na protocole Ubwoko. Nyuma yo gutembera gusinziriye cyangwa igihe cyagenwe cyashize, igikoresho kizohereza ibicuruzwa byinjira mubintu bizwi nk "umuterankunga".

Hanyuma, "gusesengura ibintu" byumvikana kuri ziriya nyandiko, zitanga ubushishozi muburyo bwo kubona amashusho, imibare, hamwe na raporo irambuye yamateka nigihe nyacyo. Mubimenyerezo, abakusanya hamwe nabasesengura akenshi usanga ari ikintu kimwe, akenshi bahujwe mubisubizo binini byo kugenzura imikorere.

NetFlow ikora kuri leta. Iyo imashini yumukiriya igeze kuri seriveri, NetFlow izatangira gufata no gukusanya metadata kuva itemba. Nyuma yamasomo arangiye, NetFlow izohereza inyandiko imwe yuzuye kubakusanya.

Nubwo bigikoreshwa cyane, NetFlow v5 ifite aho igarukira. Imirima yoherejwe hanze irakosowe, kugenzura bishyigikirwa gusa mubyerekezo byinjira, kandi tekinoroji igezweho nka IPv6, MPLS, na VXLAN ntabwo ishyigikiwe. NetFlow v9, nayo yiswe Flexible NetFlow (FNF), ikemura zimwe murizo mbogamizi, zemerera abakoresha kubaka inyandikorugero yihariye no kongeramo inkunga kubuhanga bushya.

Abacuruzi benshi bafite kandi ibikorwa byabo bwite bya NetFlow, nka jFlow yo muri Juniper na NetStream yo muri Huawei. Nubwo iboneza rishobora gutandukana muburyo bumwe, ibyo bikorwa akenshi bitanga inyandiko zitemba zihuza nabakusanya NetFlow hamwe nabasesengura.

Ibintu by'ingenzi biranga NetFlow:

~ Amakuru atemba.

~ Gukurikirana ibinyabiziga: NetFlow itanga igaragara muburyo bwimodoka zumuhanda, zemerera abayobozi kumenya porogaramu zo hejuru, aho ziherereye, ninkomoko yumuhanda.

~Kumenya Anomaly: Mugusesengura amakuru atemba, NetFlow irashobora gutahura ibintu bidasanzwe nko gukoresha umurongo mwinshi, gukoresha urusobe, cyangwa uburyo budasanzwe bwimodoka.

~ Isesengura ry'umutekano: NetFlow irashobora gukoreshwa mugushakisha no gukora iperereza kubyabaye mumutekano, nko kugabura guhakana serivisi (DDoS) cyangwa kugerageza kwinjira utabifitiye uburenganzira.

Imirongo ya NetFlow: NetFlow yagiye ihinduka mugihe, kandi hasohotse verisiyo zitandukanye. Impapuro zimwe zizwi zirimo NetFlow v5, NetFlow v9, na NetFlow yoroheje. Buri verisiyo itangiza ibyongerwaho nubushobozi bwinyongera.

IPFIX:

IPFIX ni iki?

Igipimo cya IETF cyagaragaye mu ntangiriro ya 2000, Internet Protocol Flow Amakuru yohereza hanze (IPFIX) irasa cyane na NetFlow. Mubyukuri, NetFlow v9 yabaye ishingiro rya IPFIX. Itandukaniro ryibanze hagati yibi nuko IPFIX ari igipimo gifunguye, kandi gishyigikirwa nabacuruzi benshi bahuza imiyoboro usibye Cisco. Usibye imirima mike yinyongera yongewe muri IPFIX, imiterere nubundi irasa. Mubyukuri, IPFIX rimwe na rimwe ndetse yitwa "NetFlow v10".

Bitewe nuko bisa na NetFlow, IPFIX ifite inkunga nini mubisubizo byo kugenzura imiyoboro hamwe nibikoresho byurusobe.

IPFIX (Internet Protocol Flow Information Export) ni protocole isanzwe ifunguye yakozwe na Internet Engineering Task Force (IETF). Ishingiye kuri NetFlow verisiyo 9 kandi itanga imiterere isanzwe yo kohereza ibicuruzwa biva mubikoresho byurusobe.

IPFIX yubakiye kumyumvire ya NetFlow ikanaguka kugirango itange ibintu byoroshye kandi bihuze hagati yabacuruzi nibikoresho bitandukanye. Itangiza igitekerezo cyinyandikorugero, itanga ibisobanuro byimbaraga byimiterere yimiterere yibirimo. Ibi bifasha gushyiramo imirima yihariye, gushyigikira protocole nshya, no kwaguka.

Ibintu by'ingenzi biranga IPFIX:

~ Inyandikorugero-ishingiye ku buryo: IPFIX ikoresha inyandikorugero kugirango isobanure imiterere n'ibiri mu nyandiko zitemba, zitanga ihinduka mu kwakira amakuru atandukanye hamwe na protocole yihariye.

~ Imikoranire: IPFIX ni igipimo gifunguye, cyemeza ubushobozi buhoraho bwo gukurikirana imigendekere yabacuruzi nibikoresho bitandukanye.

~ Inkunga ya IPv6: IPFIX kavukire ishyigikira IPv6, bigatuma ibera mugukurikirana no gusesengura traffic mumiyoboro ya IPv6.

~Umutekano wongerewe.

IPFIX ishyigikiwe cyane nabacuruzi banyuranye bahuza ibikoresho, bigatuma igurisha idafite aho ibogamiye kandi ihitamo cyane mugukurikirana imiyoboro.

 

None, ni irihe tandukaniro riri hagati ya NetFlow na IPFIX?

Igisubizo cyoroshye nuko NetFlow ari protocole ya Cisco yatangijwe ahagana mu 1996 naho IPFIX nigipimo cyayo cyemewe umuvandimwe.

Porotokole zombi zikora intego imwe: gushoboza abajenjeri n'abayobozi gukusanya no gusesengura urwego rw'urusobe IP igenda. Cisco yateje imbere NetFlow kugirango uhinduranya na router zayo zisohore aya makuru yingirakamaro. Urebye ubwiganze bwibikoresho bya Cisco, NetFlow yahise ihinduka de-facto yo gusesengura umuhanda. Nyamara, abanywanyi b’inganda bamenye ko gukoresha protocole yihariye igenzurwa na mukeba wayo mukuru atari igitekerezo cyiza bityo IETF ikayobora umuhate wo gushyiraho protocole ifunguye yo gusesengura ibinyabiziga, aribyo IPFIX.

IPFIX ishingiye kuri NetFlow verisiyo ya 9 kandi yatangijwe bwa mbere ahagana mu 2005 ariko byafashe imyaka itari mike kugirango ibone inganda. Kuri iyi ngingo, protocole zombi zirasa cyane kandi nubwo ijambo NetFlow riracyagaragara cyane mubikorwa byinshi (nubwo atari byose) bihuye nibisanzwe IPFIX.

Dore imbonerahamwe yerekana muri make itandukaniro riri hagati ya NetFlow na IPFIX:

Icyerekezo	NetFlow	IPFIX
Inkomoko	Ikoranabuhanga ryihariye ryatejwe imbere na Cisco	Inganda-isanzwe protocole ishingiye kuri NetFlow verisiyo 9
Ibipimo ngenderwaho	Ubuhanga bwihariye bwa Cisco	Gufungura bisanzwe byasobanuwe na IETF muri RFC 7011
Guhinduka	Impinduramatwara ihindagurika hamwe nibintu byihariye	Ihinduka ryinshi nubusabane hagati yabacuruzi
Imiterere yamakuru	Ibipaki binini	Inyandikorugero ishingiye kuburyo bwihariye bwo gutondeka inyandiko
Inkunga y'icyitegererezo	Ntabwo ashyigikiwe	Inyandikorugero zidasanzwe zo guhuza umurima woroshye
Inkunga y'abacuruzi	Ibikoresho bya Cisco	Inkunga yagutse kubacuruzi
Kwaguka	Guhitamo kugarukira	Kwinjizamo imirima yihariye hamwe namakuru yihariye
Itandukaniro rya Porotokole	Cisco yihariye	Inkunga ya IPv6 kavukire, yongerewe amajwi yo guhitamo
Ibiranga umutekano	Ibiranga umutekano muke	Ubwikorezi bwo Gutwara Umutekano (TLS) ibanga, ubutumwa bwuzuye