{"guid":"56846834-12f4-495f-b92f-8cae32b8f1c2","title":"Netzwerküberwachung mit ELK","subtitle":null,"slug":"CC16_-_51_-__-_sub_lounge_-_201605221500_-_netzwerkuberwachung_mit_elk_-_alexander_bohm","link":"https://events.sublab.io/en/CC16/public/events/51.html","description":"Was läuft da eigentlich im meinem Netz, werden sich der eine oder die\nandere beim gelegentlichen Blick auf dem Networksniffer im Heim- oder\nFirmennetzwerk denken. Eine Datenaufbereitung kann dabei schwierig\nwerden. Einzelne Datenströme gehen schnell unter, was auch mögliche\nbösartige Software ausnutzen könnte.\n\nMit einer Reihe von Open-Source-Werkzeugen ist es allerdings möglich,\nsich einen passablen Netzwerkmonitor aufzubauen. Im Vortrag wird dabei\neinen Lösungsansatz mittels der ELK-Architektur vorgestellt. ELK steht\ndabei für eine Big-Data-Stack, der die Dokumenten-orientierte Datenbank\nElasticsearch, das Datenverarbeitungswerkzeug Logstash und die\nVisualisierungsoberfläche Kibana umfasst. Durch die Zusammenschaltung\nverschiedener Software (iptables, syslog, softflowd), die die meisten\nLinux-Distributionen mitbringen, kann damit ein einfaches,\nübersichtliches und interaktives System implementiert werden, das auch\nfür nicht Netzwerkspezialisten bedienbar ist.\n\nInteressierte Zuhörer sollten dabei eine Reihe von Kenntnisse im Bereich\nLinux-Administration, JSON-RPC oder Netzwerk-Protokollen mitbringen.\n","original_language":"deu","persons":["Alexander Böhm"],"view_count":595,"promoted":false,"date":"2016-05-22T15:00:00.000+02:00","release_date":"2016-05-22T02:00:00.000+02:00","updated_at":"2026-06-12T23:45:05.520+02:00","tags":[],"length":1767,"duration":1767,"thumb_url":"https://static.media.ccc.de/media/events/cryptocon/2016/51-hd.jpg","poster_url":"https://static.media.ccc.de/media/events/cryptocon/2016/51-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/cryptocon/2016/56846834-12f4-495f-b92f-8cae32b8f1c2-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/cryptocon/2016/56846834-12f4-495f-b92f-8cae32b8f1c2-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/CC16_-_51_-__-_sub_lounge_-_201605221500_-_netzwerkuberwachung_mit_elk_-_alexander_bohm","url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_title":"CryptoCon 16","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16","related":[{"event_id":1976,"event_guid":"b0167f2efcd6a228","weight":6},{"event_id":2358,"event_guid":"e3d020b4-0773-4577-bfc5-8f6d39c34405","weight":4},{"event_id":2368,"event_guid":"97653be6-b69f-4b01-9aba-5c2048bee35c","weight":7},{"event_id":2370,"event_guid":"8e05d290-9151-419d-8e63-3bcbb02096ab","weight":4},{"event_id":2375,"event_guid":"128d4236-6001-4483-9152-c5941314d2cb","weight":6},{"event_id":2385,"event_guid":"b55ec10e-b12f-40e0-bb25-4fee2f13ad86","weight":6},{"event_id":2581,"event_guid":"3a151ea9-1ce0-4546-a617-123207864de7","weight":6},{"event_id":2938,"event_guid":"03c8501f-d327-4228-a9fe-2635370d25d2","weight":5},{"event_id":3044,"event_guid":"c7474652-8e29-40a5-9266-a550a3060706","weight":5},{"event_id":3045,"event_guid":"9084d93f-8a0c-4689-9e2c-7e4bad7683a7","weight":10},{"event_id":3046,"event_guid":"b60d4737-8d6e-443f-91f4-f129adb204cc","weight":7},{"event_id":3048,"event_guid":"decad748-ffa3-446c-80b7-73187cba0b71","weight":6},{"event_id":3049,"event_guid":"f3711e08-9814-4426-b61b-41585f25d8ce","weight":19},{"event_id":3050,"event_guid":"279ca9f9-6c04-4b56-ab50-dccef2a8c47e","weight":9},{"event_id":3051,"event_guid":"a52b22a5-9b68-4343-a37b-84ed1b0b6bce","weight":26},{"event_id":3052,"event_guid":"cb2c6d99-f7fa-4853-a5e4-a417839530dc","weight":13},{"event_id":3053,"event_guid":"cc9d1ee5-2563-4fb1-8b8f-29e968830c60","weight":12},{"event_id":3054,"event_guid":"896d8375-9d7e-4c1a-a079-7145bd4cd1d8","weight":19},{"event_id":3055,"event_guid":"5f12f944-a22f-4e44-936c-2fee02c01297","weight":9},{"event_id":3056,"event_guid":"0a6530a2-51e2-4423-9ee4-97f59823d163","weight":20},{"event_id":3057,"event_guid":"abd7ef07-2fcf-40c5-b718-b4c93c567d83","weight":14},{"event_id":3108,"event_guid":"79db9f42-6794-4696-bb2b-28ea56102d8f","weight":15},{"event_id":3546,"event_guid":"d9b6af5a-3215-4dc7-8fc5-071c5f6f568e","weight":4},{"event_id":3615,"event_guid":"74783236-46f4-493c-9574-1b27a44847b7","weight":4},{"event_id":3640,"event_guid":"700a07e7-a9c4-437b-a4c5-4491b23a9b4a","weight":4},{"event_id":3850,"event_guid":"ae999450-3893-11e7-890f-9f81551c7b53","weight":4},{"event_id":3851,"event_guid":"a2b0d408-3f34-11e7-a2ff-b7e0ed5cc95f","weight":4},{"event_id":4666,"event_guid":"dbaa263c-62ed-4565-b184-fd85a7e6fd2c","weight":4},{"event_id":4667,"event_guid":"9b3292f5-f7bd-49f9-8c2b-5dc98d72e6a4","weight":4}],"recordings":[{"length":1767,"mime_type":"video/mp4","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1280,"height":720,"updated_at":"2016-05-22T21:20:15.807+02:00","label":"deu 720p","size":157,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/h264-hd/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_hd.mp4","url":"https://api.media.ccc.de/public/recordings/10392","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"},{"length":1767,"mime_type":"video/mp4","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-05-24T04:17:37.796+02:00","label":"deu 576p","size":83,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/h264-sd/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_sd.mp4","url":"https://api.media.ccc.de/public/recordings/10452","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"},{"length":1761,"mime_type":"audio/opus","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2016-05-24T04:19:44.650+02:00","label":"deu","size":23,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/opus/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK.opus","url":"https://api.media.ccc.de/public/recordings/10453","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"},{"length":1767,"mime_type":"video/webm","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-05-24T04:14:39.118+02:00","label":"deu 576p","size":85,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/webm-sd/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/10451","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"},{"length":1767,"mime_type":"video/webm","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1280,"height":720,"updated_at":"2016-05-24T04:26:24.866+02:00","label":"deu 720p","size":189,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/webm-hd/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/10455","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"},{"length":1761,"mime_type":"audio/mpeg","language":"deu","filename":"cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2016-05-24T04:22:12.834+02:00","label":"deu","size":27,"recording_url":"https://cdn.media.ccc.de/events/cryptocon/2016/mp3/cryptocon16-51-deu-Netzwerkueberwachung_mit_ELK.mp3","url":"https://api.media.ccc.de/public/recordings/10454","event_url":"https://api.media.ccc.de/public/events/56846834-12f4-495f-b92f-8cae32b8f1c2","conference_url":"https://api.media.ccc.de/public/conferences/cryptocon16"}]}