from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on CPU Network Storage node Flash Data DoS in reverse! 11 Compute node CPU Network Storage node Flash Data So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We 12 So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We can blindly drop DoS 13 But could we reduce data transfer size? eBPF filter-reduce 14 Filter Reduce input

Other 资产同步（X-Pack） ⽀持对公有云、私有云资产的⾃动同步；⽀持对局域⽹内资产的⾃动发现； 远程应⽤ 全新的远程应⽤设计体系，⽀持⾃动管理远程应⽤（MySQL Workbench8、Navicat Premium 16 (X-Pack) ）和⼀键部署远程应⽤发布机； 作业中⼼ ⽀持对批量资产执⾏快捷命令、命令脚本以及 Playbook 脚本； 个性化设置（X-Pack） ⽀持⾃定义 LOGO 进⾏运维审计。 JumpServer 的数据库审计功能 数据库运维安全审计 Database Auditing 连接⽅式 命令⾏⽅式 数据库代理直连⽅式，可使⽤数据库管理⼯具（例如 Navicat、SQLyog 等）进⾏直连操作 Web GUI ⽅式 远程应⽤ ⽀持的数据库 MySQL 数据库 MariaDB 数据库 Redis 数据库 MongoDB 数据库 Oracle 数据库（X-Pack）

从这些机器上去搜集可能保存着各类敏感⽹络资产的账号密码表" ⽐如, *.ls,*.doc,*.docx, *.txt.... 抓取各类 "数据库客户端⼯具中保存各种数据库连接账号密码 ⽐如,Navicat,SSMS[MSSQL⾃带客户端管理⼯具,⾥⾯也可能保存的有密码(加密后的base64)] 抓取当前系统 "注册表中保存的各类账号密码hash" [ Windows ] 抓取当前系统所有

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 15 Data export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. Service a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 15 Data export . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. Service a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling

to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. Service a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling single package. Data gathering • availability and performance checks • support for SNMP (both trapping and polling), IPMI, JMX, VMware monitoring • custom checks • gathering desired data at custom intervals

to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. IT a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling single package. Data gathering • availability and performance checks • support for SNMP (both trapping and polling), IPMI, JMX, VMware monitoring • custom checks • gathering desired data at custom intervals

to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. IT a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling single package. Data gathering • availability and performance checks • support for SNMP (both trapping and polling), IPMI, JMX, VMware monitoring • custom checks • gathering desired data at custom intervals

to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. IT a fast reaction to server problems. Zabbix offers excellent reporting and data visualization features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling single package. Data gathering • availability and performance checks • support for SNMP (both trapping and polling), IPMI, JMX, VMware monitoring • custom checks • gathering desired data at custom intervals

to set up Zabbix to monitor your environment, from setting up hosts to getting essential data to viewing data to configuring notifications and remote commands to be executed in case of problems. IT a fast reaction to server problems. Zabbix offers excellent reporting and data visualisation features based on the stored data. This makes Zabbix ideal for capacity planning. Zabbix supports both polling single package. Data gathering • availability and performance checks • support for SNMP (both trapping and polling), IPMI, JMX, VMware monitoring • custom checks • gathering desired data at custom intervals