Cours 16 — Monitoring Réseau

---

1. SNMP

1.1 Principe

SNMP (Simple Network Management Protocol) permet la gestion et la supervision des équipements réseau.

Diagramme en cours de génération...

1.2 Versions SNMP

1.3 Configuration SNMP

# SNMPv2c sur switch Cisco
snmp-server community public RO
snmp-server community private RW
snmp-server location Paris-DC
snmp-server contact admin@example.com
snmp-server host 10.0.0.100 traps version 2c public

# SNMPv3
snmp-server group MYGROUP v3 priv
snmp-server user admin MYGROUP v3 auth sha AuthKey123 priv aes 256 PrivKey123
snmp-server enable traps

1.4 Compteurs clés

# OIDs courants
snmpwalk -v2c -c public 10.0.0.1 .1.3.6.1.2.1.2.2.1.10  # ifInOctets
snmpwalk -v2c -c public 10.0.0.1 .1.3.6.1.2.1.2.2.1.16  # ifOutOctets
snmpwalk -v2c -c public 10.0.0.1 .1.3.6.1.2.1.1.3.0      # sysUptime
snmpwalk -v2c -c public 10.0.0.1 .1.3.6.1.2.1.25.3.3.1.2 # CPU

---

2. NetFlow / sFlow / IPFIX

2.1 Comparatif

Diagramme en cours de génération...

2.2 Configuration NetFlow

flow exporter FLOW-EXPORT
 destination 10.0.0.100
 source Loopback0
 transport udp 2055
 template data timeout 60

flow monitor FLOW-MONITOR
 exporter FLOW-EXPORT
 record netflow ipv4 original-input
 cache timeout active 60

interface GigabitEthernet0/1
 ip flow monitor FLOW-MONITOR input

2.3 NetFlow Analysis

# nfdump
nfdump -R /data/nfcapd/ -s ip -n 10
nfdump -R /data/nfcapd/ -c 100 -o "fmt:%sa %da %pkt"
nfdump -R /data/nfcapd/ "proto tcp and port 80"

---

3. Prometheus + Grafana

3.1 Architecture

Diagramme en cours de génération...

3.2 Installation

# docker-compose.yml
version: '3.8'
services:
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - grafana_data:/var/lib/grafana

  node_exporter:
    image: prom/node-exporter:latest
    network_mode: "host"
    pid: "host"
    volumes:
      - /proc:/host/proc
      - /sys:/host/sys
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'

  blackbox_exporter:
    image: prom/blackbox-exporter:latest
    ports:
      - "9115:9115"

  snmp_exporter:
    image: prom/snmp-exporter:latest
    ports:
      - "9116:9116"

3.3 Configuration Prometheus

# prometheus.yml
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "rules/*.yml"

scrape_configs:
  - job_name: 'node'
    static_configs:
      - targets: ['localhost:9100']
        labels:
          env: 'prod'

  - job_name: 'blackbox'
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
      - targets:
          - https://example.com
          - https://api.example.com/health
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox_exporter:9115

  - job_name: 'snmp'
    static_configs:
      - targets:
          - 10.0.0.1  # switch
          - 10.0.0.2  # router
    metrics_path: /snmp
    params:
      module: [if_mib]
      target:
        - 10.0.0.1
        - 10.0.0.2
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: snmp_exporter:9116

---

4. Wireshark / tcpdump

4.1 tcpdump

# Capturer tout le trafic sur eth0
tcpdump -i eth0 -w capture.pcap

# Filtrer par port
tcpdump -i eth0 port 80 or port 443

# Filtrer par hôte
tcpdump -i eth0 host 10.0.0.1

# Filtrer par protocole
tcpdump -i eth0 tcp
tcpdump -i eth0 icmp
tcpdump -i eth0 arp

# Afficher en hex
tcpdump -i eth0 -X port 80

# Lire un fichier
tcpdump -r capture.pcap
tcpdump -r capture.pcap 'tcp port 443'

4.2 tshark

# Statistiques
tshark -r capture.pcap -q -z io,phs
tshark -r capture.pcap -q -z conv,tcp
tshark -r capture.pcap -q -z endpoints,ip

# Afficher les champs spécifiques
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port

# HTTP analysis
tshark -r capture.pcap -Y 'http.request' -T fields \
    -e http.host -e http.request.uri -e http.response.code

---

5. Nmap

# Scan de ports
nmap -sS -p 1-65535 10.0.0.1
nmap -sT -p 80,443 10.0.0.0/24

# Détection OS
nmap -O 10.0.0.1

# Service detection
nmap -sV 10.0.0.1

# NSE Scripts
nmap --script=http-title 10.0.0.1
nmap --script=ssl-enum-ciphers -p 443 example.com
nmap --script=vuln 10.0.0.1

# Scan rapide
nmap -T4 -F 10.0.0.0/24

---

6. SmokePing / MTR

6.1 SmokePing

# Target configuration
*** Targets ***
probe = FPing

menu = Top
title = Network Latency

+ targets
menu = Targets
title = Target List

++ router
title = Core Router
host = 10.0.0.1

++ gateway
title = Internet Gateway
host = 8.8.8.8

++ cloud
title = Cloud Endpoint
host = api.example.com

6.2 MTR

# Combinaison traceroute + ping
mtr 8.8.8.8
mtr --report 8.8.8.8
mtr --report-cycles 100 8.8.8.8
mtr -c 100 -r -n 8.8.8.8

---

7. Telegraf + InfluxDB

# telegraf.conf
[[inputs.net]]
  interfaces = ["eth0"]
  percollect = true

[[inputs.netstat]]
  fields = ["tcp_established", "tcp_time_wait", "tcp_close_wait"]

[[inputs.ping]]
  urls = ["8.8.8.8", "1.1.1.1"]
  count = 3
  interval = "10s"

[[inputs.snmp]]
  agents = ["udp://10.0.0.1:161"]
  version = 2
  community = "public"

[[outputs.influxdb]]
  urls = ["http://influxdb:8086"]
  database = "network"

---

Résumé

Diagramme en cours de génération...