Network monitoring with FOSS
summary
Covers capturing raw packets with Wireshark, summarizing conversations as flow data (NetFlow/ntop with an open-source DPI) and ingesting machine data into the ELK stack (Logstash → Elasticsearch → Kibana) for dashboards. Recommends IDS/IPS like Snort and Suricata, and the Security Onion distro to bundle them. Describes deployment: inline TAP vs switch SPAN (SPAN risks packet drops on >1Gb), ntop on a mirrored port or TAP, and even a Linux bridge or Raspberry Pi for inline capture; notes open source equals functionality but less vendor support.
AI-written summary · about
chapters (4)
related talks
24mA Study on Intrusion Detection Systems with a Practical Experiment on Snort
24mNetwork Data Analysis With Elastic Stack
26mNetwork Observability with IPFIX, Prometheus and Elastic Stack
29mPractical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence...
35mNetwork Flow Monitoring in Kubernetes with Contiv/VPP CNI and Elastic Stack
51mAdvanced approaches to traffic inspection & network diagnosis w/
35mNetwork Flow Monitoring in Kubernetes with Contiv/VPP CNI and the Elastic Stack
29mFinding the Needle in a Haystack: Tenant-Level Network...