Do you monitor network traffic? How? - eviltoast

With my zoo of docker containers and multiple servers hosted locally or on some cloud providers, I feel the need more and more to understand what kind of network traffic is happening. Seeing my outbound traffic on some cloud providers I’m sometimes wondering “huh-where did that traffic come from?”.

And honestly I have to say: I don’t know. Monitoring traffic is a real hurdle since I’m doing a lot via tunnels / wireguard in between servers or to my clients. When I spin up a network analysis tool such as ntopng, I do see a lot of traffic happening that is “Wireguard”. Cool. That doesn’t help me one bit.

I would have to do some deep package inspection I suppose and SSL interception to actually understand WHAT is doing stuff / where network traffic comes from. Honestly I wouldn’t be sure what stuff would be happening if there were some malicious thing running on the server and I really don’t like that. I want to see all traffic and be able to assign it to “known traffic” or in other words - “this traffic belongs to Jellyfin”, “That traffic is my gitea instance”, “the other traffic is syncthing” or something along those lines.

Is there a solution you beautiful people in this subreddit recommend or use? Don’t you care?

  • SpongederpSquarefap@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Yep, monitoring in multiple places with Zabbix

    I have pfSense as well (soon to be OPNsense) and that shows traffic per network it’s connected to, so that’s great for live traffic

    Zabbix monitors the networks and collects traffic data

    Zabbix also monitors all containers and their network traffic