Nyob rau niaj hnub no txoj kev nyuaj, kev kub ceev, thiab feem ntau encrypted network ib puag ncig, ua tiav kev pom kev zoo yog qhov tseem ceeb rau kev ruaj ntseg, kev saib xyuas, thiab ua raws.Network Packet Brokers (NPBs)tau hloov zuj zus los ntawm cov TAP yooj yim aggregators rau hauv cov txheej txheem ntse, ntse uas yog qhov tseem ceeb rau kev tswj xyuas dej nyab ntawm cov ntaub ntawv tsheb thiab xyuas kom cov cuab yeej saib xyuas thiab kev ruaj ntseg ua haujlwm tau zoo. Nov yog cov ncauj lus kom ntxaws txog lawv cov ntawv thov tseem ceeb scenarios thiab cov kev daws teeb meem:
Core Problem NPBs Solve:
Niaj hnub nimno tes hauj lwm tsim kom muaj kev khiav tsheb loj heev. Txuas kev ruaj ntseg tseem ceeb thiab cov cuab yeej saib xyuas (IDS/IPS, NPM/APM, DLP, forensics) ncaj qha mus rau kev sib txuas hauv network (ntawm SPAN chaw nres nkoj lossis TAPs) tsis muaj txiaj ntsig thiab feem ntau ua tsis tau vim:
1. Cov cuab yeej tshaj tawm: Cov cuab yeej tau swamped nrog cov tsheb tsis cuam tshuam, xa cov pob ntawv thiab tsis muaj kev hem thawj.
2. Tool Inefficiency: Cov cuab yeej pov tseg cov peev txheej ua cov ntaub ntawv duplicate lossis tsis tsim nyog.
3. Complex Topology: Distributed networks (Data Centers, Cloud, Branch Offices) ua rau centralized saib xyuas nyuaj.
4. Encryption Dig Muag Spots: Cov cuab yeej tsis tuaj yeem tshawb xyuas cov tsheb khiav (SSL/TLS) yam tsis muaj kev decryption.
5. Txwv tsis pub SPAN Resources: SPAN cov chaw nres nkoj siv cov kev hloov pauv thiab feem ntau tsis tuaj yeem lis cov kab-tus nqi tag nrho.
NPB Solution: Intelligent Traffic Mediation
NPBs zaum ntawm lub network TAPs / SPAN chaw nres nkoj thiab cov cuab yeej saib xyuas / kev ruaj ntseg. Lawv ua raws li kev txawj ntse "tub ceev xwm tsheb," ua:
1. Kev sib sau ua ke: Muab cov tsheb khiav los ntawm ntau qhov sib txuas (lub cev, virtual) rau hauv cov khoom sib koom ua ke.
2. Kev lim dej: Xaiv xa mus rau tsuas yog muaj feem cuam tshuam rau cov cuab yeej tshwj xeeb raws li cov txheej txheem (IP/MAC, VLAN, raws tu qauv, chaw nres nkoj, daim ntawv thov).
3. Load Balancing: Faib cov tsheb thauj mus los sib npaug thoob plaws ntau zaus ntawm tib lub cuab yeej (piv txwv li, clustered IDS sensors) rau scalability thiab resilience.
4. Deduplication: Tshem tawm cov ntawv luam uas zoo ib yam ntawm cov pob ntawv uas raug ntes ntawm cov kev sib txuas ntxiv.
5. Packet Slicing: Txiav cov pob ntawv (tshem tawm cov nyiaj them poob haujlwm) thaum khaws cov headers, txo cov bandwidth rau cov cuab yeej uas tsuas yog xav tau metadata xwb.
6. SSL/TLS Decryption: Teem caij encrypted (siv cov yuam sij), nthuav tawm cov ntawv ntshiab rau cov cuab yeej tshuaj xyuas, tom qab ntawd rov encrypting.
7. Replication/Multicasting: Xa tib lub tsheb khiav mus rau ntau yam cuab yeej ib txhij.
8. Advanced Processing: Metadata extraction, flow generation, timestamping, masking rhiab cov ntaub ntawv (xws li, PII).
Nrhiav ntawm no kom paub ntau ntxiv txog tus qauv no:
Mylinking™ Network Packet Broker (NPB) ML-NPB-3440L
16 * 10/100/1000M RJ45, 16 * 1/10GE SFP +, 1 * 40G QSFP thiab 1 * 40G / 100G QSFP28, Max 320Gbps
Cov ncauj lus kom ntxaws Application Scenarios & Solutions:
1. Txhim kho Kev Saib Xyuas Kev Ruaj Ntseg (IDS/IPS, NGFW, hem Intel):
○ Scenario: Cov cuab yeej kev ruaj ntseg tau dhau los ntawm qhov ntim siab ntawm East-West kev tsheb khiav hauv qhov chaw cov ntaub ntawv, tso cov pob ntawv pov tseg thiab tsis muaj kev hem thawj rau sab nraud. Cov tsheb khiav encrypted hides siab phem payloads.
○ NPB Solution:Sib sau ua ke ntawm kev sib txuas tseem ceeb hauv DC.
* Siv cov ntxaij lim dej granular kom xa cov tsheb khiav tsis txaus ntseeg nkaus xwb (xws li, cov chaw nres nkoj tsis yog tus qauv, cov subnets tshwj xeeb) rau IDS.
* Load tshuav nyiaj li cas hla ib pawg ntawm IDS sensors.
* Ua SSL / TLS decryption thiab xa cov ntawv ntshiab mus rau IDS/Thiab Intel platform rau kev soj ntsuam tob.
* Deduplicate tsheb los ntawm kev rov ua dua.Qhov tshwm sim:Kev txheeb xyuas qhov kev hem thawj siab dua, txo qis qhov tsis zoo, ua kom zoo dua IDS cov peev txheej siv.
2. Optimizing Performance Monitoring (NPM/APM):
○ Scenario: Network Performance Monitoring cov cuab yeej tawm tsam los cuam tshuam cov ntaub ntawv los ntawm ntau pua qhov sib txuas (WAN, ceg haujlwm, huab). Tag nrho pob ntawv ntes rau APM yog kim heev thiab bandwidth-intensive.
○ NPB Solution:
* Sib sau ua ke ntawm thaj chaw sib cais TAPs / SPANs mus rau hauv nruab nrab NPB ntaub.
* Lim cov tsheb thauj mus los tsuas yog xa cov ntawv thov tshwj xeeb ntws (xws li VoIP, SaaS tseem ceeb) rau APM cov cuab yeej.
* Siv pob ntawv hlais rau NPM cov cuab yeej uas feem ntau xav tau cov ntaub ntawv ntws / sijhawm ua haujlwm (headers), txo qis kev siv bandwidth.
* Rov ua dua cov kev ntsuas kev ua haujlwm tseem ceeb rau ob qho tib si NPM thiab APM cov cuab yeej.Qhov tshwm sim:Holistic, correlated kev ua tau zoo saib, txo cov nqi cuab yeej, minimized bandwidth nyiaj siv ua haujlwm.
3. Huab Visibility (Public/Private/Hybrid):
○ Scenario: Tsis muaj neeg nyob hauv TAP nkag rau hauv huab huab (AWS, Azure, GCP). Nyuaj ntes thiab coj lub tshuab virtual / thawv tsheb mus rau kev ruaj ntseg thiab saib xyuas cov cuab yeej.
○ NPB Solution:
* Siv virtual NPBs (vNPBs) hauv huab ib puag ncig.
* vNPBs coj mus rhaub virtual hloov tsheb (piv txwv li, ntawm ERSPAN, VPC Traffic Mirroring).
* Lim, sib sau ua ke, thiab thauj khoom sib npaug East-West thiab North-South huab huab.
* Kev ruaj ntseg qhov av cuam tshuam rov qab mus rau hauv lub tsev NPBs lub cev lossis cov cuab yeej saib xyuas huab.
* Ua ke nrog cov kev pabcuam huab-native visibility.Qhov tshwm sim:Kev ruaj ntseg zoo ib yam thiab kev saib xyuas kev ua haujlwm thoob plaws hybrid ib puag ncig, kov yeej huab visibility txwv.
4. Kev Tiv Thaiv Tsis Muaj Ntaub Ntawv (DLP) & Kev Ua Raws Cai:
○ Scenario: DLP cov cuab yeej yuav tsum tau tshuaj xyuas cov tsheb khiav tawm sab nraud rau cov ntaub ntawv rhiab heev (PII, PCI) tab sis raug dej nyab nrog cov tsheb tsis sib xws. Kev ua raws cai yuav tsum tau saib xyuas cov ntaub ntawv tswj xyuas tshwj xeeb.
○ NPB Solution:
* Lim cov tsheb thauj mus los tsuas yog xa tawm cov dej ntws tawm xwb (xws li destined rau hauv internet lossis cov neeg koom tes tshwj xeeb) rau DLP lub cav.
* Siv cov ntaub ntawv sib sib zog nqus soj ntsuam (DPI) ntawm NPB txhawm rau txheeb xyuas cov ntws uas muaj cov ntaub ntawv tswj hwm thiab muab qhov tseem ceeb rau cov cuab yeej DLP.
* Daim npog ntsej muag cov ntaub ntawv (xws li, daim npav rho nyiaj) hauv pob ntawvua ntejxa mus rau cov cuab yeej saib xyuas tsawg dua rau kev ua raws li kev txiav txim siab.Qhov tshwm sim:Kev ua haujlwm zoo dua ntawm DLP, txo qis qhov tsis zoo, kev soj ntsuam kev ua raws cai, txhim kho cov ntaub ntawv ntiag tug.
5. Network Forensics & Troubleshooting:
○ Scenario: Kev kuaj xyuas qhov teeb meem kev ua haujlwm nyuaj lossis ua txhaum cai yuav tsum muaj tag nrho cov ntawv ntim (PCAP) los ntawm ntau lub ntsiab lus dhau sijhawm. Triggering captures manually yog qeeb; khaws cia txhua yam yog siv tsis tau.
○ NPB Solution:
* NPBs tuaj yeem nres tsheb tsis tu ncua (ntawm kab tus nqi).
* Kho cov teeb meem tshwm sim (xws li, qhov ua yuam kev tshwj xeeb, kev sib tsoo tsheb, kev ceeb toom kev hem thawj) ntawm NPB kom tau txais kev cuam tshuam cov tsheb khiav mus rau cov khoom siv txuas nrog pob ntawv.
* Ua ntej lim cov tsheb xa mus rau cov cuab yeej ntes khaws cia tsuas yog qhov tsim nyog.
* Rov ua dua cov kwj dej tseem ceeb rau cov cuab yeej ntes yam tsis muaj kev cuam tshuam cov cuab yeej tsim khoom.Qhov tshwm sim:Faster mean-time-to-resolution (MTTR) rau kev sib tsoo / ua txhaum cai, tsom xam kev ntes, txo nqi cia.
Implementation Considerations & Solutions:
○Scalability: Xaiv NPBs nrog qhov chaw nres nkoj txaus thiab kev nkag mus (1/10/25/40/100GbE+) los daws cov tsheb khiav tam sim no thiab yav tom ntej. Modular chassis feem ntau muab qhov zoo tshaj plaws scalability. Virtual NPBs scale elastically nyob rau hauv huab.
○Resiliency: Siv cov NPBs (HA pairs) thiab rov ua dua txoj hauv kev rau cov cuab yeej. Xyuas kom lub xeev synchronization hauv HA teeb. Leverage NPB load balancing rau cov cuab yeej resilience.
○Management & Automation: Centralized tswj consoles yog qhov tseem ceeb. Nrhiav APIs (RESTful, NETCONF/YANG) rau kev koom ua ke nrog orchestration platforms (Ansible, Puppet, Kws ua zaub mov) thiab SIEM / SOAR systems rau kev hloov pauv txoj cai raws li kev ceeb toom.
○Kev ruaj ntseg: Ruaj ntseg NPB tswj interface. Tswj kev nkag mus kom nruj. Yog hais tias decrypting tsheb khiav, xyuas kom nruj cov cai tswj xyuas qhov tseem ceeb thiab kev ruaj ntseg raws rau kev hloov pauv tseem ceeb. Xav txog kev npog cov ntaub ntawv rhiab.
○Kev sib koom ua ke ntawm cov cuab yeej: Xyuas kom NPB txhawb nqa cov cuab yeej sib txuas (lub cev / virtual interfaces, raws tu qauv). Tshawb xyuas kev sib raug zoo nrog cov cuab yeej tshwj xeeb.
Yog li ntawd,Network Packet Brokerstsis xaiv luxuries lawm; lawv yog qhov tseem ceeb hauv kev tsim kho vaj tse rau kev ua tiav kev ua haujlwm network pom kev nyob rau hauv lub sijhawm niaj hnub no. Los ntawm kev txawj ntse sib sau ua ke, lim dej, ntsuas qhov sib npaug, thiab ua cov tsheb khiav, NPBs txhawb kev ruaj ntseg thiab saib xyuas cov cuab yeej ua haujlwm ntawm qhov ua tau zoo thiab ua tau zoo. Lawv rhuav tshem cov kev pom kev pom, kov yeej cov teeb meem ntawm kev teev thiab kev encryption, thiab thaum kawg muab qhov pom tseeb uas xav tau los tiv thaiv kev sib txuas, ua kom pom kev ua tau zoo, ua tau raws li txoj cai, thiab daws teeb meem sai. Kev ua raws li NPB lub tswv yim muaj zog yog ib kauj ruam tseem ceeb ntawm kev tsim kom muaj kev saib xyuas ntau dua, ruaj ntseg, thiab ua haujlwm zoo.
Lub sij hawm xa tuaj: Plaub Hlis-07-2025
