Measure the test taker's knowledge about network traffic analysis and System Monitoring salon records.

1. Use omnipeek

 

1) How to intercept data

 

A. Use arp spoofing to make machines in the same network segment think that the attacker is a gateway and send data to the packet capture machine. The attacker routes the data to the real gateway.

 

B. Use a vswitch or vro for internal port forwarding

 

C. Install software on a real vswitch or vro to capture packets, but this may affect the performance.

 

D. Use the dhcp attack software to attack the dhcp server, so that the dhcp server can allocate the ip address and impersonate the dhcp server to assign the gateway to itself.

 

You can use software to counterfeit data packets to fill the route table of the vro and change it to a vswitch.

 

2) usage of and or of the omnipeek filter, definition of the keyword, select the data packet of an ip address, you can regularly execute packet capture

 

2. Monitoring Software

 

0) Software Installation

 

1) How does mrtg communicate with cacti through snmp? The pass @ router ip address must be defined.

 

1) mrtg directly generates images and does not use databases

 

2) cacti data is stored in mysql. The cacti monitoring chart is intuitive.

 

3) The ngios configuration file should write the host to a configuration file and generate a template.

 

4) ganglia has fewer contents.

 

This article is from the "one party" blog