Isingeniso
Eminyakeni yamuva nje, inani lezinsizakalo zamafu ezimbonini zaseShayina liyakhula. Izinkampani zobuchwepheshe zisebenzise ithuba lomjikelezo omusha wenguquko yezobuchwepheshe, zenze ngenkuthalo ukuguqulwa kwedijithali, zandisa ucwaningo nokusetshenziswa kobuchwepheshe obusha njenge-cloud computing, i-big data, ubuhlakani bokwenziwa, i-blockchain kanye ne-Internet yezinto, futhi zathuthukisa amakhono azo esayensi nobuchwepheshe. Ngokuthuthuka okuqhubekayo kobuchwepheshe bamafu kanye ne-virtualization, izinhlelo zokusebenza eziningi ezikhungweni zedatha ziyasuka ekhampasi yokuqala ebonakalayo ziye epulatifomu yamafu, futhi ithrafikhi empumalanga-ntshonalanga endaweni yamafu yezikhungo zedatha ikhula kakhulu. Kodwa-ke, inethiwekhi yendabuko yokuqoqwa kwethrafikhi ebonakalayo ayikwazi ukuqoqa ngqo ithrafikhi empumalanga-ntshonalanga endaweni yamafu, okuholela ekutheni ithrafikhi yebhizinisi endaweni yamafu ibe yindawo yokuqala. Sekuyinkambiso engenakugwenywa ukufeza ukukhishwa kwedatha yethrafikhi empumalanga-ntshonalanga endaweni yamafu. Ukwethulwa kobuchwepheshe obusha bokuqoqwa kwethrafikhi empumalanga-ntshonalanga endaweni yamafu kwenza uhlelo lokusebenza olusetshenziswa endaweni yamafu lube nokusekelwa okuphelele kokuqapha, futhi lapho kuvela izinkinga nokwehluleka, ukuhlaziywa kokubamba amaphakethe kungasetshenziswa ukuhlaziya inkinga nokulandelela ukugeleza kwedatha.
1. Ithrafikhi yendawo yamafu empumalanga nentshonalanga ayikwazi ukuqoqwa ngqo, ukuze uhlelo lokusebenza endaweni yamafu lungakwazi ukusebenzisa ukutholwa kokuqapha ngokusekelwe ekugelezeni kwedatha yebhizinisi ngesikhathi sangempela, futhi abasebenzi bokusebenza nokulungisa abakwazi ukuthola ngesikhathi ukusebenza kwangempela kohlelo lokusebenza endaweni yamafu, okuletha izinzuzo ezithile ezifihliwe ekusebenzeni okunempilo nokuzinzile kohlelo lokusebenza endaweni yamafu.
2. Ithrafikhi yasempumalanga nentshonalanga endaweni yamafu ayikwazi ukuqoqwa ngqo, okwenza kube nzima ukukhipha ngqo amaphakethe edatha ukuze ahlaziywe lapho kuvela izinkinga kuzinhlelo zokusebenza zebhizinisi endaweni yamafu, okuletha ubunzima obuthile endaweni yamaphutha.
3. Njengoba izidingo eziqinile zokuphepha kwenethiwekhi kanye nokuhlolwa okuhlukahlukene, njengokuqapha ukuthengiselana kwesicelo se-BPC, uhlelo lokuthola ukungena kwe-IDS, uhlelo lokuhlola i-imeyili kanye nensizakalo yamakhasimende, isidingo sokuqoqwa kwethrafikhi empumalanga-ntshonalanga endaweni yamafu naso siya ngokuya siphuthuma. Ngokusekelwe ekuhlaziyweni okungenhla, sekuyindlela engenakugwenywa yokufeza ukukhishwa kwedatha yethrafikhi empumalanga-ntshonalanga endaweni yamafu, nokwethula ubuchwepheshe obusha bokuqoqwa kwethrafikhi empumalanga-ntshonalanga endaweni yamafu ukwenza uhlelo lokusebenza olusetshenziswa endaweni yamafu lungaba nokusekelwa okuphelele kokuqapha. Lapho kuvela izinkinga nokwehluleka, ukuhlaziywa kokubamba amaphakethe kungasetshenziswa ukuhlaziya inkinga nokulandelela ukugeleza kwedatha. Ukufeza ukukhishwa nokuhlaziywa kwethrafikhi empumalanga-ntshonalanga endaweni yamafu kuyisikhali esinamandla somlingo sokuqinisekisa ukusebenza okuzinzile kwezinhlelo zokusebenza ezisetshenziswa endaweni yamafu.
Izilinganiso ezibalulekile ze-Virtual Network Traffic Capture
1. Ukusebenza kokuthatha ithrafikhi yenethiwekhi
Ithrafikhi empumalanga nentshonalanga ithatha ingxenye engaphezu kwengxenye yethrafikhi yesikhungo sedatha, futhi ubuchwepheshe bokuthola ukusebenza okuphezulu buyadingeka ukuze kufezwe ukuqoqwa okugcwele. Ngesikhathi esifanayo sokuthola, eminye imisebenzi yokucubungula kwangaphambili njengokunciphisa, ukunqamula, kanye nokunciphisa ubukhali kudingeka iqedwe ngezinsizakalo ezahlukene, okwandisa izidingo zokusebenza.
2. Izinsizakusebenza Ezingaphezulu
Iningi lamasu okuqoqa ithrafikhi empumalanga nentshonalanga kudingeka lithathe izinsiza zokubala, zokugcina kanye nenethiwekhi ezingasetshenziswa kule nsizakalo. Ngaphezu kokusebenzisa lezi zinsiza kancane ngangokunokwenzeka, kusenesidingo sokucabanga ngezindleko zokusebenzisa ukuphathwa kobuchwepheshe bokuthola. Ikakhulukazi uma ubukhulu bama-node bukhula, uma izindleko zokuphatha zibonisa nomkhuba okhuphukayo oqondile.
3. Izinga Lokungena
Ubuchwepheshe bamanje bokuthola obuvamile buvame ukudinga ukwengeza ukucushwa okwengeziwe kwenqubomgomo yokuthenga ku-hypervisor noma izingxenye ezihlobene. Ngaphezu kokungqubuzana okungenzeka nezinqubomgomo zebhizinisi, lezi zinqubomgomo zivame ukwandisa umthwalo ku-hypervisor noma ezinye izingxenye zebhizinisi futhi zithinte i-SLA yesevisi.
Kusukela encazelweni engenhla, kungabonakala ukuthi ukubanjwa kwethrafikhi endaweni yamafu kufanele kugxile ekubanjweni kwethrafikhi empumalanga-ntshonalanga phakathi kwemishini ebonakalayo nezinkinga zokusebenza. Ngesikhathi esifanayo, ngenxa yezici eziguquguqukayo zepulatifomu yamafu, ukuqoqwa kwethrafikhi endaweni yamafu kudinga ukudabula imodi ekhona yesibuko sokushintsha sendabuko, futhi kufeze ukuthunyelwa kokuqoqa nokuqapha okuguquguqukayo nokuzenzakalelayo, ukuze kuhambisane nomgomo wokusebenza nokugcinwa okuzenzakalelayo kwenethiwekhi yamafu. Ukuqoqwa kwethrafikhi endaweni yamafu kudinga ukufeza imigomo elandelayo:
1) Qaphela umsebenzi wokuthwebula wethrafikhi empumalanga-ntshonalanga phakathi kwemishini ebonakalayo
2) Ukuthwebula kuthunyelwa ku-node yokubala, futhi ukwakheka kweqoqo elisatshalalisiwe kusetshenziselwa ukugwema izinkinga zokusebenza nokuzinza ezibangelwa isibuko sokushintsha
3) Ingazwa ngokuguquguqukayo izinguquko zezinsizakusebenza zomshini obonakalayo endaweni yamafu, futhi isu lokuqoqa lingalungiswa ngokuzenzakalelayo ngezinguquko zezinsizakusebenza zomshini obonakalayo.
4) Ithuluzi lokuthwebula kufanele libe nendlela yokuvikela ukunqwabelana ngokweqile ukuze kuncishiswe umthelela kuseva
5) Ithuluzi lokuthwebula ngokwalo linomsebenzi wokwenza ngcono ithrafikhi
6) Ipulatifomu yokuthwebula ingaqapha ithrafikhi yomshini obonakalayo eqoqwe
Ukukhethwa Kwemodi Yokuthwebula Ithrafikhi Yomshini Obonakalayo Emvelweni Yamafu
Ukuthwebula ithrafikhi yomshini obonakalayo endaweni yamafu kudinga ukufaka i-probe yokuqoqa endaweni yamafu. Ngokusho kwendawo yokuqoqwa engafakwa endaweni yamafu, imodi yokubamba ithrafikhi yomshini obonakalayo endaweni yamafu ingahlukaniswa ngezindlela ezintathu:Imodi ye-ejenti, Imodi Yomshini ObonakalayofuthiImodi Yokusingatha.
Imodi Yomshini Obonakalayo: kufakwa umshini ohlanganisiwe wokuthwebula obonakalayo kumphathi ngamunye ongokoqobo endaweni yamafu, bese kufakwa i-probe ethambile yokuthwebula emshinini obonakalayo wokuthwebula. Ithrafikhi yomsingathi iboniswa kumshini obonakalayo wokuthwebula ngokufaka ithrafikhi yekhadi lenethiwekhi ebonakalayo kuswishi ebonakalayo, bese umshini obonakalayo wokuthwebula udluliselwa epulatifomu yendabuko yokuthwebula ithrafikhi ebonakalayo ngekhadi lenethiwekhi elizinikele. Bese lisatshalaliswa epulatifomu ngayinye yokuqapha nokuhlaziya. Inzuzo ukuthi i-softswitch bypass mirroring, engenakho ukungena ekhadini lenethiwekhi yebhizinisi elikhona kanye nomshini obonakalayo, ingaqaphela nombono wezinguquko zomshini obonakalayo kanye nokufuduka okuzenzakalelayo kwezinqubomgomo ngezindlela ezithile. Ububi ukuthi akunakwenzeka ukufeza indlela yokuvikela ukunqwabelana ngokweqile ngokuthwebula umshini obonakalayo owamukela ithrafikhi ngokunganaki, futhi usayizi wethrafikhi ongaboniswa unqunywa ukusebenza kweswishi ebonakalayo, enomthelela othile ekuzinzeni kweswishi ebonakalayo. Endaweni ye-KVM, ipulatifomu yamafu idinga ukukhipha ithebula lokugeleza kwesithombe ngokulinganayo, okuyinkimbinkimbi ukuyiphatha nokuyinakekela. Ikakhulukazi lapho umshini wokusingatha wehluleka, umshini obonakalayo wokuthwebula ufana nomshini obonakalayo webhizinisi futhi uzothuthela kuma-host ahlukene neminye imishini ebonakalayo.
Imodi ye-ejenti: Faka i-soft probe yokuthwebula (i-Agent Agent) emshinini ngamunye obonakalayo odinga ukubamba ithrafikhi endaweni yamafu, bese ukhipha ithrafikhi empumalanga nasentshonalanga yendawo yamafu ngesofthiwe ye-Agent agent, bese uyisabalalisa epulatifomu ngayinye yokuhlaziya. Izinzuzo ukuthi ayizimele epulatifomu yokwenza i-virtualization, ayithinti ukusebenza kweswishi ebonakalayo, ingahamba nomshini obonakalayo, futhi ingenza ukuhlunga ithrafikhi. Okubi ukuthi ama-ejenti amaningi kakhulu adinga ukuphathwa, futhi ithonya le-Agent ngokwayo alikwazi ukukhishwa lapho kwenzeka iphutha. Ikhadi lenethiwekhi yokukhiqiza elikhona lidinga ukwabelwana ngalo ukuze kutholakale ithrafikhi ethe xaxa, okungathinta ukusebenzisana kwebhizinisi.
Imodi Yokusingatha: ngokufaka i-probe ethambile yeqoqo elizimele ku-host ngayinye ebonakalayo endaweni yamafu, isebenza kwimodi yenqubo ku-host, futhi idlulisela ithrafikhi ebanjiwe epulatifomu yendabuko yokubamba ithrafikhi ebonakalayo. Izinzuzo ziyindlela ephelele yokudlula, akukho ukungena emshinini obonakalayo, ikhadi lenethiwekhi yebhizinisi kanye nokushintsha komshini obonakalayo, indlela elula yokubamba, ukuphathwa okulula, asikho isidingo sokugcina umshini obonakalayo ozimele, ukutholwa kwe-probe elula nethambile kungafinyelela ukuvikelwa kokulayisha ngokweqile. Njengenqubo yokusingatha, ingaqapha izinsiza zokusingatha kanye nokusebenza komshini obonakalayo ukuze iqondise ukuthunyelwa kwesu lesibuko. Okubi ukuthi idinga ukusebenzisa inani elithile lezinsiza zokusingatha, futhi umthelela wokusebenza udinga ukunakwa. Ngaphezu kwalokho, amanye amapulatifomu abonakalayo angase angasekeli ukuthunyelwa kwama-probe esofthiwe okubamba ku-host.
Kusukela esimweni samanje semboni, imodi yomshini obonakalayo inezinhlelo zokusebenza efwini lomphakathi, kanti i-Agent Mode kanye ne-Host Mode zinabasebenzisi abathile efwini eliyimfihlo.
Isikhathi sokuthunyelwe: Novemba-06-2024
