0

i'm a newbie and i'm having a problem that i can't find it by google. I'm researching abbout DDoS detecting method now. As we can see that nowadays people often analyze networking traffic from router by a computer inside LAN.

But i see that there're some companies which have services for traffic monitoring and packet information capturing. I wonder how they can do it. Do they have to configure their own customer's router for the information or do something elso.

Also, can i config a router for directing its traffic to a cloud outside its network?

Thanks in advance :-)

2

DDoS can be analysed simply by checking the volume and pattern of traffic hitting the router. Any decent router will have something called SNMP (Simple Network Management Protocol). SNMP captures information about the performance of the router (in this case, it can be used for all manner of devices) and allows an external service to take the data, aggregate and report on it. One of the advantages of SNMP is that is happens out-of-bounds of the actual traffic and therefore should not impact the performance of the router and its traffic. Ideally, SNMP traffic for a router should go over a completely separate LAN (a management LAN) to the data. SNMP can be a security risk of course and so needs to be handled carefully out at the network boundary.

Any enterprise grade router will have that capability. Many consumer grade routers also have it such as my Billion 7800N.

An alternative that captures more detail and may detect DDoS attacks that simple SNMP monitoring might miss requires something in the traffic stream to intercept the traffic and analyse it. This could happen external to the router by changing the DNS entry for the network to be monitored so that it passes through an external monitoring service which, in turn, forwards the data on to the router. You can do this inside the network boundary as well of course. The danger here is adding too much latency to the traffic so that it impacts performance.

I'm not so sure what you mean by your last question. It is feasible to route incoming traffic back out again rather than inwards but I'm not sure why you would want to. Certainly if the aim were to monitor traffic, this would be a very inefficient method.

UPDATE: From your comment regarding the anturis services.

Anturis is an example of set of products that cover a number of types.

  • Server & web monitoring. These use agents that you need to install on your server. The monitors capture specific information about the performance of the servers and send them back to a recording and dashboard service centrally. Very efficient but you have to trust the service and not mind that you are sending data back to them.
  • Network Monitoring. This is done using a couple of measures.

    • Ping. Sends a simple ICMP packet regularly to your network device. The service measures the round-trip time and any lost packets. You need to allow your router (for example) to respond to this. Allowing ping can open you to denial of service attacks and many routers will have it turned off to the public side of the interface.
    • SNMP. As I said previously, this is something available on most managable network devices including virtually all routers, enterprise grade switches, access points, etc. If you intend to use an external agency to monitor SNMP, you need to make sure the traffic is secure which may not be easy.

In all of these cases, you have to take some kind of action to allow the monitoring to occur. Varying from installing software on your servers, through to reconfiguring your routers (to allow access to SNMP), through to allowing Ping from the Internet.

  • thanks for your ideas. But i still wonder how some computer have services on the cloud for analyzing the traffic of my server. Even sometimes i only have to enter the ip address of mine and they will calculate everything there. – Truong Nguyen Jun 5 '14 at 16:18
  • Perhaps you could give an example of the service you refer to? Most if not all such services generally require either an agent on your server (e.g. NewRelic, monitor.us, etc.) or a "bug" on your website (e.g. Google Analytics). Indeed, you are now talking about a different type of monitoring - not your router but a server. – Julian Knight Jun 5 '14 at 20:16
  • sorry for being late. Here i meant like this service. i just have to enter some information. – Truong Nguyen Jun 8 '14 at 14:19
  • Please see my update. There is no service that will "calculate everything" without some action on your part unless you have a disastrously insecure router. – Julian Knight Jun 8 '14 at 20:45
1

Most enterprise-sized routers/firewalls include Intrusion Detection (or Prevention) Systems (IDS or IPS) which can notice and block certain kinds of network attacks. Most of these devices also regularly download new attack pattern definitions from the manufacturer, much like your PC's antivirus does. Some manufacturers also offer a service where they'll remotely manage your firewall for you, if you don't have a local person with those skills. Your traffic doesn't need to be sent to them - they just "call in" to your local device and set it up to do the work within your own network.

  • Thanks for your idea. But you know IDPS at this time can't defend against sophisticating attacks like DDoS for an example. Sometimes, some poor enterprise can't purchase enough devides for defending againts DDoS attack. So i decide to make a service for detecting DDoS attack, starting with traffic analyzation from the cloud to watch the router's flow. That's my idea :-) – Truong Nguyen Jun 5 '14 at 16:24
  • To achieve this you would require a LOT of infrastructure. See the CloudFlare service as an example - quite probably the best on the market. – Julian Knight Jun 5 '14 at 20:18
  • so like this :( maybe my solution isn't good anymore. Can you suggest me any more solutions for monitoring traffic. You know, the detection tools purchased like Firewalls are so expensive :-) – Truong Nguyen Jun 8 '14 at 14:27
  • I think you need to set up a new question that is more specific though you might be better switching to Software Recommendations as this group doesn't allow software recommendations. – Julian Knight Jun 10 '14 at 14:12
  • sorry for being late again :( thank you for your recommendation :-) i'll switch now :-) it seems to be not in the security issues so much :-) – Truong Nguyen Jun 11 '14 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.