Self-Hosted Main

RemindMe! 3 days

ReminMe! 2 days

It seems as if you would like to see all traffic identified up to layer 7. That is pretty much enterprise level traffic inspection. I’ve done a lot of it on the edge of our network using a Palo Alto firewall with pretty much all software licenses enabled. I could create full blown reports of single users and/or applications. I sure did point out some co-workers ánd applications who where misbehaving on our network.

Depending on what you run for a perimeter device, but elasticsearch is free and can give you incredible visibility into your network.

That said, it can be a bit of a beast to learn.

Simpler deployment is how I have it, running as Zenarmor Sensei inside my opnsense router/firewall which IS my edge.

There's also Prometheus and grafana. Grey log.

Lots and lots of options however, just need to feed these log engines your syslogs.

That's the magic ticket!

I do. I monitor it in a lot of ways.

1. IDS at the router
2. Anomoli Detection at the router
3. Host based agents on everything I can
4. L7 Firewalls on everything I can
5. DNS based monitoring for everything

Wireguard and Cloudflare Tunnels make network traffic monitoring difficult because it's all encrypted traffic.

I've been a network engineer, security analyst, security engineer, and SOAR engineer over the course of the last 20 years; I don't want to think about any of that shit when I'm not being paid for it. I have backups of the things I can't replace, no port forwarding/ingress rules from WAN on the firewall, and the network is heavily segmented and uses least privilege. The random security stuff I leverage is set to drop/block and my family does a good job being vocal when something isn't working. If I needed to start over tomorrow, I'd just build a new server with Ansible playbooks on my GitHub.

I own a WISP with about 100 clients and admin another wisp/fisp with around 500 clients.

I love "the dude" by mikrotik. It pulls data via SNMP and gives me a great heads up overview of everything. it also graphs the data over time.

I use LibreMNS also to pull network data via SNMP and it graphs historical data.

Easy, set up a mail server, then 98% of your traffic will be inbound attack attempts on that. Like mine...

I’ve gone down this rabbit hole and have yet to find a solution I like. The only routes I haven’t gone down yet are the grey log or sec onion, as the learning curve is steep.

I do use crowdsec and that has been semi-helpful at showing me where a scanner is trying to poke around and on what service.

I currently use ntopng’s community version and that’s been acceptable for now. Some parts are a bit confusing and the documentation didn’t help me understand, but the tables are really well laid out and I can easily see the server/cliebt relationship with in and outbound traffic. I’ll try and share screenshots of how it looks for me to see if that helps you.

I have a pfsense and use ntopng

I have been using libreNMS for over four years and love it. I started to play with checkmk for its agent but found the network side of checkmk is also lovely/easy to work with. I recommend looking at either of these. Both can run in docker or docker-compose.

I found this and will be testing it. Looks like it's free for home use.

https://corelight.com/

Why not use Macvlan and join your Dockers to that rather than a bridge to Tailscale or Cloudflared? Then they are broken out so you can apply monitoring.

I use cadvisor to get stats and Prometheus and grafana. Works very well

I use my fortigate router as it logs everything natively. Logs DNS request, outbound traffic, internal lan local traffic, and so much more

I would suggest looking at Wazuh and setting up a SIEM stack based on it. It would provide what you need and is highly customisable to needs.

I use Pi-Hole & NextDNS for all my DNS and I check once a week, for extra security I run a Fortigate 61E with AV/IPS and of course VLAN just for IoT and NVR.

Do you monitor network traffic?

Generally, no. But I seriously restrict container networking, most of my containers are unable to reach internet, unless absolutely necessary. Also, my firewall is not super-restrictive, but it is different from defaults :)

Sometimes I do some monitoring though.

I wrote a couple scripts that ingest my Apache and SSHD logs to tell me how many hits I had, how many unique hosts they came from and where they are in the world. It even spits out a nice map at the end of the day: https://imgur.com/aJ6aVZp

Securityonion is a great ids system. I used their distributed system, so I have 1 mini pc as a sensor and another as a manager/search. Works wonderful.

Yep, monitoring in multiple places with Zabbix

I have pfSense as well (soon to be OPNsense) and that shows traffic per network it's connected to, so that's great for live traffic

Zabbix monitors the networks and collects traffic data

Zabbix also monitors all containers and their network traffic

Following

You probably want something like netgenius one. That's enterprise grade but might be a good starting point to research. Alternatively you could look at ips/ids systems that can apply a set of definitions or rules to the analysis, ubiquiti or fortinet has some solutions for this sort of thing but I'm sure there are alternatives out there which would be better depending on your needs.

You are kind of asking several questions here though and may need to clarify a bit what goal you have in mind for the solution you are looking for.

Zabbx agent on my docker host, can monitor traffic per container.

RemindMe! 2 days

I was recently thinking about setting up a transparent squid proxy at router level, I'm curious if it could be useful in this context.