Slashdot Mirror

← Back to Domains

Domain: balabit.com

Stories and comments across the archive that link to balabit.com.

Comments · 4

  1. Re:OpenNMS by inKubus · · Score: 1 · on What Would You Want In a Large-Scale Monitoring System?

    I'd recommend a suite of stuff, not just NMS. It's good, but nagios can be made so compact and small. MTRG/rrdtool is the only solution for gathering stats. There's a ton of third party visualization stuff for all monitoring systems. When you're talking about monitoring system, you have to decide the facets you're looking to cover. Number one is a current status of systems, ie: a table of systems and their ping, load, whatever. Number two is automation. Can the system kick off escalating notifications when a host is down? Can the system kick off corrective actions, such as restarting httpd or power cycling a switch? Can it integrate with your asset management and help desk system? Number three is data. Can it provide long-term data for peak analysis? For visualization?

    We're using nagios right now and it seems quite good for all these things. Yes, it's a little hard to set up, and takes some time to get right. But it has all the features necessary to monitor a network. Even better, it's easy to write plugins, scripts, and integrate with other existing systems.

    What about network security monitoring? Traffic monitoring? And you need something like syslog-ng to collect your logs so you can take action when something goes down.

    Also, I think Zabbix is pretty good also.

  2. Zorp by OeLeWaPpErKe · · Score: 1 · on Open Source For Perimeter Security

    For real (tm) security, try a (true) layer-7 firewall (in case anyone knows a product that matches up to this, cisco's pix does NOT, pf does not, and checkpoint does not either, they just have some checks that can be easily fucked up by playing with tcp window size (setting it very low for example))

    http://www.balabit.com/products/zorp/

    Check it out.

  3. Zorp by Zizi · · Score: 1 · on What is the Best Firewall for Servers?

    Consider using Zorp for more control. http://www.balabit.com/ It has a GPL and a commercial version.

  4. they are everywhere! by whelck · · Score: 2, Informative · on What Network Sniffing Tools Do You Use?
    I'm actually a little surprised at the small amount of network tools that have been suggested. While Ethereal is a god send (it recently solved a very puzzling DHCP issue that we were having on one of our networks), it isn't the end of what you need to have.

    Buy one linux server, and then discover the wonders that are ping and SNMP. Simple tools such as Nagios and MRTG (or NRG or Cricket) can do wonders for helping spot problem switches/routers and congestion spots.

    For example, every device we have is pinged 3 times every minute, and queried for bandwidth usage every 5 minutes. This has helped in finding bottlenecks, and the occasional switch that reboots every few minutes. (MRTG alone convinced the higher ups to buy new gear for our Datacenter and give it a dedicated link to the Core).

    Also, setting up a wonderful SNMP trap server can be very useful. It allowed us to find a switch that likes to reboot at random intervals (the switch is 5 years old and being replaced this weekend). Of course, having it send a trap whenever a switch reboots is just the start of what certain switches/routers can do.

    Also the use of Snort to sniff traffic that can be potentially malicious can be very helpful in tuning firewalls and finding those script kiddies. (use ACID for a pretty front end)

    Another nice tool is NTOP Does almost everything NetFlow does and has a pretty graphical frontend built in. (I recently used this to find out that one of our firewalls was sending gigs of syslog data to the wrong server.)

    And with the mention of syslog, might as well throw out a link for syslog-ng. yet another useful tool.

    Basically the point of this is to say that sometimes it's best to let your equipment do that talking. They'll usually tell you what's wrong, just as long as you've set them up to do so. I found that once we put a lot of these tools into full production, we were able to cut down on our need to sniff the line whenever problems came up. This isn't to say that Ethereal isn't needed. That's hardly the case. Its use is still huge and shown all the time.