{"id":213583,"date":"2020-11-05T18:10:07","date_gmt":"2020-11-05T17:10:07","guid":{"rendered":"https:\/\/www.interviewns.de\/?p=213583"},"modified":"2020-12-01T12:45:39","modified_gmt":"2020-12-01T11:45:39","slug":"distributed-pcap-monitoring","status":"publish","type":"post","link":"https:\/\/www.interviewns.de\/en_us\/distributed-pcap-monitoring\/","title":{"rendered":"Distributed PCAP Monitoring"},"content":{"rendered":"[et_pb_section admin_label=”section”]\n\t\t\t[et_pb_row admin_label=”row”]\n\t\t\t\t[et_pb_column type=”4_4″][et_pb_text admin_label=”Text”]\n

Who decides on “what” and “where” of the packet monitoring<\/strong><\/p>\n\n\n\n

Packet monitoring is usually. Appliance-based, either physical or virtual.
You have to install an appliance somewhere that reads and interprets the network data.
An appliance can only evaluate the data that it can “read”, it must be connected directly to the network connection to be measured, or the network data must be actively sent to the appliance via the network, which represents an additional load or additional security weak point .
If you use appliances, you accept that you cannot measure at many critical points where you are “blind”.<\/p>\n\n\n\n

The alternative<\/strong>
At the same time, a packet-reading process runs on every server, client, Linux OS, firewall, load balancer, etc., free of charge and error-free. This is usually. used on demand, but can also be used for monitoring.
All you need is software that analyzes the files and detects weak points.
Of course, it should support the protocols and fields that Wireshark network analysts are used to<\/p>\n\n\n\n

InterTrace<\/span> imports the data in realtime whenever PCAP files are generated and evaluates them with the same syntax as Wireshark – but now for long-term, aggregated, evaluated – and this in the cloud or in the local network.
Since SLIC uses Tshark-Diaply Fitler, all metrics and protocol fields that Wireshark knows can be used, an estimated 250,000.
In SLIC, the user organizes his scenarios as he needs it: the web service including LDAP, database, web server in a web scenario, the security analysis of a service in one security – and the WAN monitoring in another.
Scenarios can be summarized or assessed separately and correlated with one another.<\/p>\n\n\n\n

Conclusion<\/strong><\/p>\n\n\n\n

InterTrace<\/span> can help you
\u2022 to import 100s of pcap files on the fly
\u2022 organize them that you can clearly identify the different scenario
\u2022 Use the input of pcap files for long time monitoring
\u2022 Analyze the files by easy customizable metrics
\u2022 Create alerts and incidents that you see on the sport your critical issues
\u2022 just monitoring
o based on your data anywhere
o focusing on you critical object
o using your logic to evaluate your data<\/p>\n\n\n\n


<\/p>\n\n\n\n

\n