Network sensor architecture and full packet capture at scale
You design where sensors go, TAP versus SPAN, packet brokers and long-term full packet retention, building privacy and legal duties into the plan.
Level 501 · 14 lessons · 12 practice labs
Lessons
Designing visibility
- The visibility map: north-south and east-west traffic
- Sensor placement: perimeter, core, data centre, remote office
- TAP and SPAN: loss, duplicates and cost
- Short task: draw a sensor placement plan for a three-tier corporate network
Scale and retention
- Packet brokers: replication, filtering and load balancing
- High-speed capture: AF_PACKET, multiple queues and measuring loss
- Retention sizing: bandwidth, days and disk
- Fast search in an indexed PCAP archive
- Lightweight sensors at remote branches with central logging
- Short task: produce a 30-day retention budget for a 10 Gb/s link
Governance
- Privacy by design: masking, access and audit trails
- Retention periods and international legal frameworks
- Sensor health monitoring: loss, lag and disk alarms
- Capstone: propose a sensor architecture and retention policy for a fictional hospital network
Practice labs
- Draw a visibility map: Mark north-south and east-west traffic on a given network diagram.
- Sensor placement for a three-tier network: Choose sensor locations for border, core and data centre and write what traffic each sees.
- Design a lightweight sensor for remote branches: Design a lightweight sensor and central logging layout for Gelincik Okulları's twelve branches within bandwidth limits.
- Compare TAP and SPAN: Compare TAP and SPAN in a table on loss, duplicate packets and cost.
- Detect and remove duplicate packets: Find SPAN-induced duplicate packets in a capture, measure their rate and produce a deduplicated file.
- Measure loss with AF_PACKET: Configure multi-queue AF_PACKET capture on the lab sensor and measure the drop rate under load.
- Calculate the daily disk need: Calculate the disk for one day of full packet retention at an average 200 Mb/s.
- A 30-day budget for 10 Gb/s: Produce a 30-day retention budget for full packet, truncated packet and metadata-only options.
- Fast search in an indexed archive: Index a rotating PCAP archive by time and address and compare the time to find one session against an unindexed search.
- Read sensor health indicators: Decide which sensor is in trouble from drop, delay and disk usage values.
- Set alarms for loss and disk: Write a monitoring script alerting when packet drop exceeds one percent or disk exceeds eighty-five percent.
- A retention policy for a hospital network: Define masking, access, audit trail and retention periods for Lavinya Klinikleri with reference to international frameworks.
About this course
You design where sensors go, TAP versus SPAN, packet brokers and long-term full packet retention, building privacy and legal duties into the plan.
What you will learn
- Designing visibility
- Scale and retention
- Governance
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.