pktvisor icon indicating copy to clipboard operation
pktvisor copied to clipboard

dynamic policies per Top 10 IP

Open weyrick opened this issue 4 years ago • 1 comments

We want the ability to capture policies based on current top 10 IP addresses querying the server. This epic will represent the story.

weyrick avatar Jun 21 '21 13:06 weyrick

  • The idea behind this request is to get more granular insights about the traffic hitting a given server running pktvisor. The list of top talkers could be useful e.g. for traffic filtering in certain attack scenarios.
  • That being said, in the future it would make sense to generate stats not only based on top 10 source IP addresses querying the server, but also based e.g. on the destination IP on the server. The reasoning here is that there may be multiple services listening on different IP addresses (and/or ports) on a single server.
  • I could imagine that once there is such a framework for capturing top talkers based on destination IP address, it could offer enough flexibility to configure and capture top talkers based on e.g. src/dst port/IP address pairs, etc. to meet each operator's needs.

pmarciniakNS1 avatar Jun 21 '21 16:06 pmarciniakNS1