Chapter 12: Network Monitoring Using Linux
In this chapter, we'll be discussing various network monitoring and management protocols, tools, and approaches. We'll cover logging using syslog, which can be used to log events of interest on various hosts. This will be extended to a cloud-based collection of syslog events, allowing you to both summarize firewall traffic and compare your traffic patterns against those across the internet.
We'll discuss using SNMP to collect performance statistics of your various network devices and hosts, which can be useful in both troubleshooting and capacity planning.
Finally, we'll use NetFlow and other flow-collection protocols to look for traffic anomalies – we'll use NetFlow to follow a typical incident investigation, uncovering a large data exfiltration event.
In particular, we'll cover the following topics:
- Logging using Syslog
- The Dshield project
- Collecting NetFlow data on Linux