-
|
Does anyone have experience monitoring large links with Security Onion (like 40gig links)? I am wondering what kind of a system I would have to build to monitor such a network connection. |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
Would that bean Internet-connected link? |
Beta Was this translation helpful? Give feedback.
-
|
First, what is the actual utilization of the 40gig link? Depending on the answer to that question, you might want to consider a flow-based load balancer with multiple sensors behind it. https://docs.securityonion.net/en/2.3/hardware.html#sensor-hardware-considerations |
Beta Was this translation helpful? Give feedback.
-
|
Hi Doug, do you know a solution for flow based load balancing? We uses Arista Switches and mirror the 10G links for rx and tx to separated 10G monitoring ports and put them into the bridge in the forward node. But with the load of the internet line we have to think about splitting the traffic - as you wrote - into flows and then divide the traffic on several forward nodes. Btw we use Citrix NetScaler for load balancing as well, but i am not shure if the NetScaler may handle this for "monitoring" traffic. So i am interested in a proofed solution. |
Beta Was this translation helpful? Give feedback.
-
@mnasec The link I posted above also links to some companies that offer flow-based load balancing: |
Beta Was this translation helpful? Give feedback.
First, what is the actual utilization of the 40gig link?
Depending on the answer to that question, you might want to consider a flow-based load balancer with multiple sensors behind it.
https://docs.securityonion.net/en/2.3/hardware.html#sensor-hardware-considerations