Solution for traffic capturing from router

Question

i'm a newbie and i'm having a problem that i can't find it by google. I'm researching abbout DDoS detecting method now. As we can see that nowadays people often analyze networking traffic from router by a computer inside LAN.

But i see that there're some companies which have services for traffic monitoring and packet information capturing. I wonder how they can do it. Do they have to configure their own customer's router for the information or do something elso.

Also, can i config a router for directing its traffic to a cloud outside its network?

Thanks in advance :-)

Answer 1

DDoS can be analysed simply by checking the volume and pattern of traffic hitting the router. Any decent router will have something called SNMP (Simple Network Management Protocol). SNMP captures information about the performance of the router (in this case, it can be used for all manner of devices) and allows an external service to take the data, aggregate and report on it. One of the advantages of SNMP is that is happens out-of-bounds of the actual traffic and therefore should not impact the performance of the router and its traffic. Ideally, SNMP traffic for a router should go over a completely separate LAN (a management LAN) to the data. SNMP can be a security risk of course and so needs to be handled carefully out at the network boundary.

Any enterprise grade router will have that capability. Many consumer grade routers also have it such as my Billion 7800N.

An alternative that captures more detail and may detect DDoS attacks that simple SNMP monitoring might miss requires something in the traffic stream to intercept the traffic and analyse it. This could happen external to the router by changing the DNS entry for the network to be monitored so that it passes through an external monitoring service which, in turn, forwards the data on to the router. You can do this inside the network boundary as well of course. The danger here is adding too much latency to the traffic so that it impacts performance.

I'm not so sure what you mean by your last question. It is feasible to route incoming traffic back out again rather than inwards but I'm not sure why you would want to. Certainly if the aim were to monitor traffic, this would be a very inefficient method.

UPDATE: From your comment regarding the anturis services.

Anturis is an example of set of products that cover a number of types.

• Server & web monitoring. These use agents that you need to install on your server. The monitors capture specific information about the performance of the servers and send them back to a recording and dashboard service centrally. Very efficient but you have to trust the service and not mind that you are sending data back to them.

• Network Monitoring. This is done using a couple of measures.

  • Ping. Sends a simple ICMP packet regularly to your network device. The service measures the round-trip time and any lost packets. You need to allow your router (for example) to respond to this. Allowing ping can open you to denial of service attacks and many routers will have it turned off to the public side of the interface.
  • SNMP. As I said previously, this is something available on most managable network devices including virtually all routers, enterprise grade switches, access points, etc. If you intend to use an external agency to monitor SNMP, you need to make sure the traffic is secure which may not be easy.

In all of these cases, you have to take some kind of action to allow the monitoring to occur. Varying from installing software on your servers, through to reconfiguring your routers (to allow access to SNMP), through to allowing Ping from the Internet.

Answer 2

Most enterprise-sized routers/firewalls include Intrusion Detection (or Prevention) Systems (IDS or IPS) which can notice and block certain kinds of network attacks. Most of these devices also regularly download new attack pattern definitions from the manufacturer, much like your PC's antivirus does. Some manufacturers also offer a service where they'll remotely manage your firewall for you, if you don't have a local person with those skills. Your traffic doesn't need to be sent to them - they just "call in" to your local device and set it up to do the work within your own network.