Wanguard 6.2 User Guide
Choosing a Method of Traffic Monitoring and DDoS Detection
Choosing a Method of Traffic Monitoring and DDoS Detection
This chapter describes the traffic monitoring technologies supported by Wanguard Sensor.
There are four Wanguard Sensor “flavors” that differ only in the way they obtain traffic information:
●
Packet Sensor
analyzes packets. It can be used on appliances that are either deployed in-line (servers,
firewalls, routers, bridges, IDSes, load-balancers) or connected to a mirrored port or TAP.
In switched networks, only the packets for a specific device reach the device's network card. If the server
running a Packet Sensor is not deployed in-line, in the main data path, then a network TAP or a switch or
router that offers a “monitoring port” or “mirroring port” must be used. In this case, the network device
sends copies of data packets traveling through selected ports or VLANs to the monitoring port. Packet
Sensor inspects every packet it receives and conducts packet-based traffic analysis.
●
Flow Sensor
analyzes flows. It is used for monitoring NetFlow® (jFlow, NetStream, cflowd), sFlow® and
IPFIX data.
Many routers and switches can collect IP traffic statistics and periodically send them as flow records to a
Flow Sensor. Because the flow protocol already performs pre-aggregation of traffic data, the flow data
sent to Flow Sensor is much smaller than the monitored traffic, and this makes Flow Sensor a good
option for monitoring remote or high-traffic networks. The main downside of flow-based traffic analysis
is that pre-aggregating traffic data adds a delay of at least 30 seconds to collecting real-time traffic
statistics.
●
SNMP Sensor
monitors the bandwidth usage of routers and switches on a port-by-port basis.
When this technology is used, an SNMP Sensor queries the device (e.g. router, switch, server) for the
traffic counters of each port with small data packets. These are triggering reply packets from the device.
Compared to other bandwidth monitoring technologies, the SNMP option is very basic and offers no IP-
specific information. SNMP creates the least CPU and network load.
●
Sensor Cluster
aggregates pre-existing Sensor traffic data into a single, unified anomaly detection and/or
IP graphing domain.
Sensor Cluster sums up the traffic data collected by Packet Sensors, Flow Sensor and SNMP Sensor
interfaces and performs the same tasks as the other Sensors (IP graphing, IP accounting, anomaly
detection, etc.).
For redundancy, high availability and to be able to view packet traces and flow dumps, use Flow Sensor(s)
and Packet Sensor(s) simultaneously.
- 8 -
Summary of Contents for wanguard 6.2
Page 1: ......
