Kodi pali kusiyana kotani pakati pa NetFlow ndi IPFIX pa Network Flow Monitoring?

NetFlow ndi IPFIX onse ndi matekinoloje omwe amagwiritsidwa ntchito powunikira komanso kusanthula ma network. Amapereka zidziwitso pamayendedwe amtaneti, kumathandizira kukonza magwiridwe antchito, kuthetsa mavuto, ndi kusanthula chitetezo.

NetFlow:

NetFlow ndi chiyani?

NetFlowndiye njira yowunikira yowunikira, yomwe idapangidwa ndi Cisco kumapeto kwa zaka za m'ma 1990. Mabaibulo angapo alipo, koma maulendo ambiri amatengera NetFlow v5 kapena NetFlow v9. Ngakhale mtundu uliwonse uli ndi kuthekera kosiyana, ntchito zoyambira zimakhala zofanana:

Choyamba, rauta, switch, firewall, kapena chipangizo chamtundu wina chidzajambula zambiri pa netiweki "mayendedwe" - makamaka mapaketi omwe amagawana mawonekedwe ofanana monga gwero ndi adilesi yopita, gwero, ndi doko, ndi protocol. mtundu. Pambuyo poyenda kwagona kapena nthawi yodziwikiratu yadutsa, chipangizocho chidzatumiza zolembera ku bungwe lotchedwa "flow collector".

Pomaliza, "flow analyzer" imamvetsetsa zolembedwazo, kupereka zidziwitso mwanjira yowonera, ziwerengero, komanso lipoti latsatanetsatane la mbiri yakale komanso nthawi yeniyeni. M'malo mwake, osonkhanitsa ndi osanthula nthawi zambiri amakhala chinthu chimodzi, nthawi zambiri amaphatikizidwa kukhala njira yayikulu yowunikira magwiridwe antchito.

NetFlow imagwira ntchito mokhazikika. Makina a kasitomala akafika pa seva, NetFlow iyamba kujambula ndikuphatikiza metadata kuchokera pakuyenda. Gawoli litatha, NetFlow idzatumiza mbiri yathunthu kwa wosonkhanitsa.

Ngakhale imagwiritsidwabe ntchito nthawi zambiri, NetFlow v5 ili ndi zoletsa zingapo. Minda yotumizidwa kunja imakhazikika, kuyang'anira kumangothandizidwa ndi njira yolowera, ndipo matekinoloje amakono monga IPv6, MPLS, ndi VXLAN sakuthandizidwa. NetFlow v9, yomwe imatchedwanso Flexible NetFlow (FNF), imathetsa zina mwazolepheretsa, kulola ogwiritsa ntchito kupanga ma tempuleti okhazikika ndikuwonjezera chithandizo chamatekinoloje atsopano.

Ogulitsa ambiri amakhalanso ndi machitidwe awo a NetFlow, monga jFlow ochokera ku Juniper ndi NetStream kuchokera ku Huawei. Ngakhale kasinthidwe kangasiyane, izi nthawi zambiri zimatulutsa zolemba zomwe zimagwirizana ndi otolera a NetFlow ndi osanthula.

Zofunikira za NetFlow:

~ Flow Data: NetFlow imapanga zolemba zoyenda zomwe zimaphatikizapo zambiri monga ma adilesi a IP, madoko, masitampu, ma paketi ndi ma byte, ndi mitundu ya protocol.

~ Kuwunika Magalimoto: NetFlow imapereka mawonekedwe mumayendedwe apamsewu, kulola olamulira kuti azindikire mapulogalamu apamwamba, ma endpoints, ndi magwero amayendedwe.

~Kuzindikira kwa Anomaly: Posanthula deta yotuluka, NetFlow imatha kuzindikira zolakwika monga kugwiritsa ntchito bandwidth mopitilira muyeso, kusokonekera kwa maukonde, kapena njira zachilendo zamagalimoto.

~ Security Analysis: NetFlow itha kugwiritsidwa ntchito kuti muzindikire ndikufufuza zochitika zachitetezo, monga kuwukiridwa kokana ntchito (DDoS) kapena kuyesa kosaloledwa.

Mitundu ya NetFlow: NetFlow yasintha pakapita nthawi, ndipo mitundu yosiyanasiyana yatulutsidwa. Mabaibulo ena odziwika akuphatikizapo NetFlow v5, NetFlow v9, ndi Flexible NetFlow. Mtundu uliwonse umabweretsa zowonjezera ndi zina zowonjezera.

IPFIX:

IPFIX ndi chiyani?

Muyezo wa IETF womwe unatuluka kumayambiriro kwa zaka za m'ma 2000, Internet Protocol Flow Information Export (IPFIX) ndi yofanana kwambiri ndi NetFlow. M'malo mwake, NetFlow v9 idakhala maziko a IPFIX. Kusiyana kwakukulu pakati pa awiriwa ndikuti IPFIX ndi muyezo wotseguka, ndipo imathandizidwa ndi ogulitsa ambiri pa intaneti kupatula Cisco. Kupatula magawo ena owonjezera omwe adawonjezedwa mu IPFIX, mawonekedwewo ali ofanana. M'malo mwake, IPFIX nthawi zina imatchedwa "NetFlow v10".

Chifukwa china ndi kufanana kwake ndi NetFlow, IPFIX imasangalala ndi chithandizo chachikulu pakati pa njira zowunikira ma netiweki komanso zida zama network.

IPFIX (Internet Protocol Flow Information Export) ndi njira yotseguka yopangidwa ndi Internet Engineering Task Force (IETF). Zimatengera mawonekedwe a NetFlow Version 9 ndipo imapereka mawonekedwe okhazikika otumizira ma rekodi otuluka kuchokera pazida zamtaneti.

IPFIX imamangirira pamalingaliro a NetFlow ndikuwakulitsa kuti azitha kusinthasintha komanso kugwirizanitsa pakati pa ogulitsa ndi zida zosiyanasiyana. Imayambitsa lingaliro la ma templates, kulola kutanthauzira kwamphamvu kwa kayendedwe ka kayendedwe ka kayendedwe kake ndi zomwe zili. Izi zimathandizira kuphatikizidwa kwa minda yachizolowezi, kuthandizira ma protocol atsopano, ndi kukulitsa.

Zofunikira za IPFIX:

~ Njira Yotengera Ma template: IPFIX imagwiritsa ntchito ma templates kuti ifotokoze momwe zimakhalira komanso zomwe zili m'mabuku oyenda, zomwe zimapereka kusinthasintha potsata magawo osiyanasiyana a deta ndi chidziwitso chodziwika bwino cha protocol.

~ Kugwirizana: IPFIX ndi mulingo wotseguka, kuwonetsetsa kuti kuwunika kumayenda mosasinthasintha pakati pa ogulitsa ndi zida zosiyanasiyana.

~ Thandizo la IPv6: IPFIX mbadwa imathandizira IPv6, ndikupangitsa kuti ikhale yoyenera kuyang'anira ndikuwunika kuchuluka kwa magalimoto mumanetiweki a IPv6.

~Chitetezo Chowonjezera: IPFIX imaphatikizapo zinthu zachitetezo monga kubisa kwa Transport Layer Security (TLS) ndi kufufuza kukhulupirika kwa uthenga kuteteza chinsinsi ndi kukhulupirika kwa data yotuluka panthawi yotumizira.

IPFIX imathandizidwa kwambiri ndi ogulitsa zida zosiyanasiyana zapaintaneti, ndikupangitsa kuti ikhale yosalowerera ndale komanso yovomerezeka kwambiri pakuwunika ma network.

 

Ndiye, pali kusiyana kotani pakati pa NetFlow ndi IPFIX?

Yankho losavuta ndiloti NetFlow ndi Cisco proprietary protocol yomwe idayambitsidwa cha 1996 ndipo IPFIX ndiye m'bale wake wovomerezeka.

Ma protocol onsewa amagwira ntchito yofanana: kupangitsa mainjiniya ndi oyang'anira ma netiweki kusonkhanitsa ndikusanthula mayendedwe amtundu wa IP pa intaneti. Cisco idapanga NetFlow kuti masiwichi ake ndi ma rauta azitha kutulutsa chidziwitso chofunikirachi. Poganizira kulamulira kwa magiya a Cisco, NetFlow idakhala mulingo wa de-facto pakuwunika kuchuluka kwa magalimoto pamaneti. Komabe, ochita mpikisano m'mafakitale adazindikira kuti kugwiritsa ntchito protocol yoyendetsedwa ndi mdani wake wamkulu sikunali lingaliro labwino ndipo chifukwa chake IETF idatsogolera kuyesetsa kukhazikitsa njira yotseguka yowunikira magalimoto, yomwe ndi IPFIX.

IPFIX idakhazikitsidwa pa mtundu wa NetFlow 9 ndipo idayambitsidwa chakumapeto kwa 2005 koma zidatenga zaka zingapo kuti itengedwe kumakampani. Pakadali pano, ma protocol awiriwa ali ofanana ndipo ngakhale mawu akuti NetFlow akadali ofala kwambiri (ngakhale si onse) amagwirizana ndi IPFIX muyezo.

Nayi tebulo lofotokozera mwachidule kusiyana kwa NetFlow ndi IPFIX:

Mbali	NetFlow	IPFIX
Chiyambi	Tekinoloje yaumwini yopangidwa ndi Cisco	Protocol yokhazikika pamakampani kutengera NetFlow Version 9
Kukhazikika	Cisco-specific technology	Open standard yofotokozedwa ndi IETF mu RFC 7011
Kusinthasintha	Mabaibulo osinthika okhala ndi mawonekedwe apadera	Kusinthasintha kwakukulu ndi kugwirizana pakati pa ogulitsa
Mtundu wa Data	Mapaketi amtundu wokhazikika	Njira yotengera ma template pamawonekedwe osinthika oyenda makonda
Thandizo la template	Osathandizidwa	Ma tempulo amphamvu ophatikizira magawo osinthika
Thandizo la ogulitsa	Makamaka zida za Cisco	Thandizo lalikulu pakati pa ogulitsa maukonde
Kukulitsa	Zosintha zochepa	Kuphatikizika kwa minda yokhazikika ndi data yeniyeni yogwiritsira ntchito
Kusiyana kwa Protocol	Zosiyanasiyana za Cisco	Thandizo la Native IPv6, njira zowonjezera zolembera zoyenda
Zotetezera	Chitetezo chochepa	Transport Layer Security (TLS) encryption, kukhulupirika kwa uthenga