homelabsecuritymonitoring/Network_-_Network_Monitoring.html at main · BoredHackerBlog/homelabsecuritymonitoring · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
<!doctype html>
<html>
<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <title>Network - Network Monitoring</title>
  <meta name="generator" content="CherryTree">
  <link rel="stylesheet" href="res/styles3.css" type="text/css" />
</head>
<body>
<div class='page'><h1 class='title'>Network - Network Monitoring</h1><br/><h1>Network Monitoring<br /></h1><br /><h2>• Network monitoring involves sniffing network traffic<br />• There are several ways to sniff traffic, however, traffic mirroring option in a switch is probably the easiest way of doing it<br />• Typically the setting in switch configuration is labeled port mirroring<br />• Sniffing machine will have two NICs, one for sniffing data and one for regular communication/internet</h2><br /><br /><a href=""><img src="images/32-1.png" alt="images/32-1.png" /></a><br /><br /><br /><h2>• The host doing the sniffing will require two network interfaces<br />• The interface doing the sniffing will need to be configured to promiscuous mode and it should not be getting an IP<br />• Mirrored traffic in the example diagram above only will contain traffic to/from the router, it is possible to mirror additional ports to capture traffic from Windows to Linux for example.<br /></h2><br /><h2>• In this example, the two interfaces are ens18 &amp; ens19, they could be named differently on another system (like eth0 or eno1).<br />• ens19 will be sniffing traffic and will be connected to the mirror port<br />   ◇ This will only receive traffic and not send any out<br />• ens18 will be connected to the router<br />   ◇ This will send/receive traffic, just like any host connected to the router &amp; internet</h2><br /><br /><a href="https://en.wikipedia.org/wiki/North-south_traffic">https://en.wikipedia.org/wiki/North-south_traffic</a><br /><a href="https://en.wikipedia.org/wiki/East-west_traffic">https://en.wikipedia.org/wiki/East-west_traffic</a><br /><br />Hardware that supports mirroring: <a href="https://docs.securityonion.net/en/2.3/hardware.html#packets">https://docs.securityonion.net/en/2.3/hardware.html#packets</a><br />RB260GS &amp; GS105E v2 are cheap and great.<br /><br />It may be simpler/easier to just get SELKS, Security-Onion, or Corelight@Home and ship logs from those platforms.<br /><a href="https://www.stamus-networks.com/selks">https://www.stamus-networks.com/selks</a><br /><a href="https://securityonionsolutions.com/software/">https://securityonionsolutions.com/software/</a><br /><a href="https://corelight.blog/2020/11/19/corelight-at-home/">https://corelight.blog/2020/11/19/corelight-at-home/</a><br /><a href="https://www.humio.com/whats-new/blog/monitor-home-network-with-corelight-humio/">https://www.humio.com/whats-new/blog/monitor-home-network-with-corelight-humio/</a><br /></div>
</body>
</html>