Applied Detection and Analysis Using Network Flow Data
|
|
|
- Reynard Williamson
- 8 years ago
- Views:
Transcription
1 Applied Detection and Analysis Using Network Flow Data Chris Sanders and Jason Smith TAP Intel-Based Detection Mandiant, a FireEye Company Chris Sanders Christian & Husband Kentuckian and South Carolinian MS, GSE, et al. Non-Profit Director BBQ Pit Master 2
2 Jason Smith Kentuckian Car Aficionado Raspberry Pi enthusiast Junkyard Engineer 3 Applied Network Security Monitoring This book should be required reading for all intrusion analysts and those looking to develop a security monitoring program. Written by analysts, for analysts. - Amazon Reviewers 4
3 Agenda Flow Data! Why it s important How you can collect it What you can do with it Tools that can help Why/How to use Flow Data in NSM/IR 5 Network Security Monitoring The collection, detection, and analysis of network security data. The goal of NSM is escalation, or to declare that an incident has occurred so that incident response can occur. Network Security Monitoring Incident Response 6
4 The NSM Cycle Collection Analysis Detection 7 Evolution of NSM Emphasis Past Detection Era Present Collection Era Future Analysis Era 8
5 NSM/IR Challenges of the Present We All Want Full PCAP Collection Easy to Capture / Filter Stream Data Detection Major Detection Tools are PCAP Oriented Analysis Gives us Who, Where, When, and What 9 NSM/IR Challenges of the Present But, It s not Feasible for Every Goal Collection Not Scalable for Extended Retention Detection Not Ideal of Hunting / Rapid Pivoting Analysis Not a Great Starting Point 10
6 Full PCAP vs. Flow Data PCAP Data Flow Data 11 Flow Data Often Called Flow / Session / NetFlow Summary of Network Communications Aggregated Record of Packets Gives Us Who, Where, When Based on the 5-tuple + Timing/Data Stats Source IP Source Port Dest IP Dest Port Protocol UDP Start Time End Time Bytes 2014/09/22T00:03: /09/22T00:04:
7 Flow Data Example stime sip dport dip dport pro bytes 2014/09/22T00:03: /09/22T00:03: /09/22T00:08: /09/22T00:08: /09/22T00:03: /09/22T00:03: /09/22T00:08: /09/22T00:08: Building Flow Records Records are Defined by Unique 5-tuples Data is added to the 5-tuple Record until a termination condition is met. 14
8 Flow Record Termination Conditions Natural Timeout End of communication per protocol (ex. TCP RST/FIN) Idle Timeout No data received for 30 seconds Active Timeout Thirty minute max timeout (configurable) 15 Collection with Flow Data
9 Generating Flow Data Generation Routers Sensors Fprobe YAF Multiple Types: NetFlow (v5,v9) IPFIX jflow More 17 Collecting Flow Data Popular Platforms Argus + Reliable + Fast Collection - Not Well Supported NFDump + Easy to Setup and Use - Not in Wide Use SiLK + Exceptional Analysis Tools - More Involved Setup 18
10 SiLK The System for Internet-Level Knowledge CERT NetSA Team Two Major Components: Packing Suite Collection and parsing of flow data Analysis Suite Filter, display, sort, count, group, mate, and more Excellent Documentation & Community 19 SiLK Collection Architecture 20
11 SiLK What You Need Flow Sources Hardware: Routers, Switches Software: YAF, fprobe SiLK Server Rwflowpack Will also have SiLK analysis suite installed Analyst Workstation Access SiLK server directly Locally mirrored database 21 SiLK Analysis Suite rwfilter - Filters through data based on conditions. rwcut - Converts flow binary data to a human readable format. rwstats - Generates statistics from flow data rwcount - Summarizes total network traffic over time 22
12 SiLK Analysis rwfilter / rwcut (1) Display all records from the beginning the current day until the current time: rwfilter --type=all --proto= pass=stdout rwcut 23 SiLK Analysis rwfilter / rwcut (2) Display all records of communication to or from Chinese IP addresses over a specific week to one local CIDR range: rwfilter --type=all --start-date=2014/08/01 --enddate=2014/08/07 --any-address= /24 --any-cc=cn --pass=stdout rwcut -- fields=stime,sip,dip,sport,dport,type 24
13 SiLK Analysis rwstats (1) Display statistics for the total amount of bytes transferred by protocol (top 10): rwfilter --type=all --proto= pass=stdout rwstats --top --count=10 --fields=proto -- value=bytes 25 SiLK Analysis rwstats (2) Show the top 10 sip,dip pairs for valid conversations (top 10) rwfilter --type=all --proto= packets=4, -- pass=stdout rwstats --top --count=10 -- fields=sip,dip --value=bytes 26
14 SiLK Analysis rwstats (3) Show the top 10 outbound destination country codes by records: rwfilter --type=out,outweb --proto= pass=stdout rwstats --top --count=10 --fields=dcc 27 SiLK Analysis Real World Examples Rwstats to discover potential ZeroAccess victims rwfilter --type=all --dport=16464,16465,16470, pass=stdout rwstats --top --fields=sip -- value=distinct:dcc --threshold=3 28
15 SiLK Analysis Real World Examples Discovering outbound data to applications using nonstandard ports. rwfilter Sampledata/sample.rw \ --plugin=app-mismatch.so \ --type=out,outweb --proto=6 \ --sport=1024- \ --packets=4- \ --flags-initial=s/surfpace \ --pass=stdout \ rwstats --fields=application,dport --count=100 \ --distinct:dport 29 Collecting Intelligence Data Friendly Intelligence Gathering Identify Services on the Network Identify Normal Behaviors of Hosts Identify Friends and Family Friends: Who a host communicates with outside the network Family: Who a host communicates with inside the network 30
16 Identifying Services Identify SSH Servers rwfilter --type=out --protocol=6 --packets=4- - -ack-flag=1 --sport=22 --pass=stdout rwcut -- fields=sip Identify Web Servers rwfilter --type=outweb --protocol=6 -- packets=4- --ack-flag=1 --sport=80,443, pass=stdout rwcut --fields=sip 31 Identifying Friends and Family Identify Friends rwfilter --type=out,outweb -- saddress= pass=stdout rwfilter --input-pipe=stdin -- dcidr= /24 --fail=stdout Identify Family rwfilter --type=out,outweb -- saddress= pass=stdout rwfilter --input-pipe=stdin -- dipset=local --fail=stdout 32
17 Detection with Flow Data Flow for Detection Signature- Based Reputation- Based Behavior- Based Statistics- Based 34
18 FlowPlotter Generates Visualizations from the Output of Flow Tools Useful for Detection-Oriented Statistics Written in BASH Flexible/Tweakable/Minimal Free/Open Source - Maintained in GitHub Browser Independent 35 FlowPlotter - GeoMap rwfilter../sampledata/sample.rw --dcc=us,cn,-- --fail=stdout./flowplotter.sh geomap dcc bytes > geomap.html 36
19 FlowPlotter - LineChart rwfilter --type=all --proto= pass=stdout./flowplotter.sh linechart 600 bytes > linechart.html 37 FlowPlotter - TreeMap rwfilter../sampledata/sample.rw --sport= dport= proto=0- --type=out --pass=stdout./flowplotter.sh treemap dip records > treemap.html 38
20 FlowPlotter - Pie/Bar/Column Chart rwfilter../sampledata/sample.rw --sport= dport= proto=0- --type=all --pass=stdout./flowplotter.sh piechart dip bytes > piechart.html 39 FlowPlotter - BubbleChart rwfilter../sampledata/sample.rw --type=all --proto= pass=stdout./flowplotter.sh bubblechart sip > bubblechart.html 40
21 FlowPlotter - Timeline rwfilter --proto=0- --type=out --sport= pass=stdout./flowplotter.sh timeline dip sip > timeline.html 41 FlowPlotter - Force Directed rwfilter../sampledata/sample.rw --scc=kr --proto=0- --type=all -- pass=stdout./flowplotter.sh forceopacity sip dip distinct:dport 100 > forcetest.html 42
22 FlowPlotter - AssetDiscovery rwfilter../sampledata/sample.rw --proto=0- --type=all --pass=stdout./flowplotter.sh assetdiscovery > assettest.html 43 Analysis with Flow
23 Flow in Analysis PCAP Only Validate Signature TP < 1% Scoping Relevant Time Range 5% Find Related Events in Time Range 10% Reduce Data Set 35% Analyze / Make Decisions ~ 50% * Based on the First Hour of Analysis 45 Flow in Analysis - Improved Validate Signature TP < 1% Scoping Relevant Time Range 5% Find Related Events in Time Range 10% Expand Data Set as Needed 5% Analyze / Make Decisions ~ 80% * Based on the First Hour of Analysis 46
24 Flow Barriers to Entry Be Prepared to Look at a LOT of Line-Based Data Very Command Line Oriented Not Welcoming to Junior-Level Analysts Hard to Display/Interpret Data Visually 47 SiLK Data Output 48
25 49 Flow Basic Analysis Tool Graphical Front-End to SiLK Easy Two-Step Install on SiLK Capable Box Install Locally to SiLK Box Install Remotely and Interact via SSH w/ Keys Rapid Pivoting Between Data Graphing Ability By Analysts, for Analysts 50
26 Getting Data with FlowBAT (CLI Mode) 51 Getting Data with FlowBAT (Guided Mode) 52
27 Manipulating FlowBAT Data 53 Pivoting with FlowBAT Data 54
28 Generating Stats with FlowBAT 55 Generating Stats with FlowBAT 56
29 Conclusion Flow Data is Underused and Underrated Easy to Collect, Enhances Detection & Analysis Minimal Barriers to Entry SiLK (Easy to Install on SO) Argus (Already Installed on SO) Bro (Already Installed on SO) 57 Thanks Folks! Questions? Chris Sanders Jason Smith Blog / Book FlowPlotter FlowBAT 58
Network Profiling Using Flow
Network Profiling Using Flow Austin Whisnant Sid Faber August 2012 TECHNICAL REPORT CMU/SEI-2012-TR-006 ESC-TR-2012-006 CERT Program http://www.sei.cmu.edu Copyright 2012 Carnegie Mellon University. This
Network Analysis with isilk
Network Analysis with isilk Presented at FloCon 2011 Ron Bandes CERT Network Situational Awareness (NetSA) Group 2011 Carnegie Mellon University 2011 Carnegie Mellon University NO WARRANTY THIS MATERIAL
Flow Based Traffic Analysis
Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City murali@ncb.ernet.in Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode
Wireshark Developer and User Conference
Wireshark Developer and User Conference Using NetFlow to Analyze Your Network June 15 th, 2011 Christopher J. White Manager Applica6ons and Analy6cs, Cascade Riverbed Technology cwhite@riverbed.com SHARKFEST
Missing the Obvious: Network Security Monitoring for ICS
Missing the Obvious: Network Security Monitoring for ICS If ICS are so vulnerable, why haven t we seen more attacks? We aren t looking! Two Key Reasons Intent Visibility Intent Why are targeted attacks
Scalable Extraction, Aggregation, and Response to Network Intelligence
Scalable Extraction, Aggregation, and Response to Network Intelligence Agenda Explain the two major limitations of using Netflow for Network Monitoring Scalability and Visibility How to resolve these issues
AlienVault Unified Security Management (USM) 4.x-5.x. Deployment Planning Guide
AlienVault Unified Security Management (USM) 4.x-5.x Deployment Planning Guide USM 4.x-5.x Deployment Planning Guide, rev. 1 Copyright AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault,
FlowViewer. Maintaining NASA s Earth Science Traffic Situational Awareness
FlowViewer Maintaining NASA s Earth Science Traffic Situational Awareness Graphic credit: Arizona/New Mexico Fire Imagery, USDA Forest Service; Remote Sensing Application Center; Image acquired from Aqua
nfdump and NfSen 18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH
18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH Some operational questions, popping up now and then: Do you see this peek on port 445 as well? What caused this peek on your
NFSEN - Update 13th TF-CSIRT Meeting 23. September 2004 Malta Peter Haag
NFSEN - Update 13th TF-CSIRT Meeting 23. September 2004 Malta Peter Haag 2004 SWITCH NFSEN ( NetFlow Sensor ) 12th TF-CSIRT Meeting Hamburg: 2004 SWITCH 2 NFSEN http://www.terena.nl/tech/task-forces/tf-csirt/meeting12/nfsen-haag.pdf
Connecting North Carolina s Future Today. Application Monitoring: ClassScape Case Study. NCSU Centennial Networking Lab
Connecting North Carolina s Future Today Application Monitoring: ClassScape Case Study John Bass NCSU Centennial Networking Lab Carla S. Hunt MCNC 1 Overview About MCNC and the School Connectivity Initiative
More Netflow Tools: For Performance and Security
More Netflow Tools: For Performance and Security Carrie Gates, Michael Collins, Michael Duggan, Andrew Kompanek and Mark Thomas Carnegie Mellon University ABSTRACT Analysis of network traffic is becoming
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag
Watch your Flows with NfSen and NFDUMP 50th RIPE Meeting May 3, 2005 Stockholm Peter Haag 2005 SWITCH What I am going to present: The Motivation. What are NfSen and nfdump? The Tools in Action. Outlook
Emerald. Network Collector Version 4.0. Emerald Management Suite IEA Software, Inc.
Emerald Network Collector Version 4.0 Emerald Management Suite IEA Software, Inc. Table Of Contents Purpose... 3 Overview... 3 Modules... 3 Installation... 3 Configuration... 3 Filter Definitions... 4
Network Monitoring and Management NetFlow Overview
Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
Introduction to Netflow
Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior
NetFlow Aggregation. Feature Overview. Aggregation Cache Schemes
NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to
Netflow Collection with AlienVault Alienvault 2013
Netflow Collection with AlienVault Alienvault 2013 CONFIGURE Configuring NetFlow Capture of TCP/IP Traffic from an AlienVault Sensor or Remote Hardware Level: Beginner to Intermediate Netflow Collection
NfSen Plugin Supporting The Virtual Network Monitoring
NfSen Plugin Supporting The Virtual Network Monitoring Vojtěch Krmíček krmicek@liberouter.org Pavel Čeleda celeda@ics.muni.cz Jiří Novotný novotny@cesnet.cz Part I Monitoring of Virtual Network Environments
Network Monitoring for Cyber Security
Network Monitoring for Cyber Security Paul Krystosek, PhD CERT Network Situational Awareness 2006 Carnegie Mellon University What s Coming Up The scope of network monitoring Cast of characters Descriptions
$100 SiLK Network Flow Sensor
$100 SiLK Network Flow Sensor Ron Bandes John Badertscher Dwight Beaver 1 Copyright 2014 Carnegie Mellon University This material is based upon work funded and supported by the Department of Defense under
Analyzing large flow data sets using. visualization tools. modern open-source data search and. FloCon 2014. Max Putas
Analyzing large flow data sets using modern open-source data search and visualization tools FloCon 2014 Max Putas About me Operations Engineer - DevOps BS, MS, and CAS in Telecommunications Work/research
Overview of Network Traffic Analysis
Overview of Network Traffic Analysis Network Traffic Analysis identifies which users or applications are generating traffic on your network and how much network bandwidth they are consuming. For example,
Fluke Networks NetFlow Tracker
Fluke Networks NetFlow Tracker Quick Install Guide for Product Evaluations Pre-installation and Installation Tasks Minimum System Requirements The type of system required to run NetFlow Tracker depends
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.
Network Management & Monitoring
Network Management & Monitoring NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools
Case Study: Instrumenting a Network for NetFlow Security Visualization Tools William Yurcik* Yifan Li SIFT Research Group National Center for Supercomputing Applications (NCSA) University of Illinois at
Ixia xstream TM 10. Aggregation, Filtering, and Load Balancing for qgbe/10gbe Networks. Aggregation and Filtering DATA SHEET
Ixia xstream TM 10 Aggregation, Filtering, and Load Balancing for qgbe/10gbe Networks The Ixia xstream 10 is a network packet broker for monitoring high-speed network traffic, letting you share the network
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
Network Security Monitoring
CEENET/GEANT Security Workshop Sofia, 2014 Network Security Monitoring An Introduction to the world of Intrusion Detection Systems Irvin Homem irvin@dsv.su.se Stockholm University Who am I? Of Indian and
Passive Logging. Intrusion Detection System (IDS): Software that automates this process
Passive Logging Intrusion Detection: Monitor events, analyze for signs of incidents Look for violations or imminent violations of security policies accepted use policies standard security practices Intrusion
Lecture 2-ter. 2. A communication example Managing a HTTP v1.0 connection. G.Bianchi, G.Neglia, V.Mancuso
Lecture 2-ter. 2 A communication example Managing a HTTP v1.0 connection Managing a HTTP request User digits URL and press return (or clicks ). What happens (HTTP 1.0): 1. Browser opens a TCP transport
Overview - Using ADAMS With a Firewall
Page 1 of 6 Overview - Using ADAMS With a Firewall Internet security is becoming increasingly important as public and private entities connect their internal networks to the Internet. One of the most popular
Flow Visualization Using MS-Excel
Flow Visualization Using MS-Excel Visualization for the Common Man Presented by Lee Rock and Jay Brown US-CERT Analysts Einstein Program Background US-CERT Mission Einstein Program > Large volumes of traffic
How To Create A Network Monitoring System (Flowmon) In Avea-Tech (For Free)
Network Traffic Performance & Security Monitoring Project proposal minimal project Orsenna;Invea-Tech FLOWMON PROBES 1000 & 100 Contents 1. Introduction... 2 1.1. General System Requirements... 2 1.2.
Protographs: Graph-Based Approach to NetFlow Analysis. Jeff Janies RedJack FloCon 2011
Protographs: Graph-Based Approach to NetFlow Analysis Jeff Janies RedJack FloCon 2011 Thesis Using social networks we can complement our existing volumetric analysis. Identify phenomenon we are missing
Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting
Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Document ID: 70974 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure Network Diagram
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
NetFlow Auditor Manual Getting Started
NetFlow Auditor Manual Getting Started Setting up NetFlow Check if your Routers or Switches Supports NetFlow. Almost all Cisco devices support NetFlow since its introduction in the 11.1 train of Cisco
Customer Tips. Network Packet Analyzer Tips. for the user. Purpose. Introduction to Packet Capture. Xerox Multifunction Devices.
Xerox Multifunction Devices Customer Tips January 15, 2004 This document applies to these Xerox products: Network Packet Analyzer Tips Purpose This document contains a procedure that Xerox customers can
Cisco ASA and NetFlow Using ASA NetFlow with LiveAction Flow Software
LiveAction Application Note Cisco ASA and NetFlow Using ASA NetFlow with LiveAction Flow Software January 2013 http://www.actionpacked.com Table of Contents 1. Introduction... 1 2. ASA NetFlow Security
Get Your FIX: Flow Information export Analysis and Visualization
Get Your FIX: Flow Information export Analysis and Visualization Joint Techs Workshop, Madison, Wisconsin, July 19, 2006 Dave Plonka plonka@doit.wisc.edu Division of Information Technology, Computer Sciences
Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop
Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop R. David Idol Department of Computer Science University of North Carolina at Chapel Hill david.idol@unc.edu http://www.cs.unc.edu/~mxrider
Indexing Full Packet Capture Data With Flow
Indexing Full Packet Capture Data With Flow FloCon January 2011 Randy Heins Intelligence Systems Division Overview Full packet capture systems can offer a valuable service provided that they are: Retaining
NFQL: A Tool for Querying Network Flow Records [6]
![NFQL: A Tool for Querying Network Flow Records [6]](/thumbs/33/16133063.jpg "NFQL: A Tool for Querying Network Flow Records [6]")
NFQL: A Tool for Querying Network Flow Records [6] nfql.vaibhavbajpai.com Vaibhav Bajpai, Johannes Schauer, Corneliu Claudiu Prodescu, Jürgen Schönwälder {v.bajpai, j.schauer, c.prodescu, j.schoenwaelder@jacobs-university.de
Network Monitoring Comparison
Network Monitoring Comparison vs Network Monitoring is essential for every network administrator. It determines how effective your IT team is at solving problems or even completely eliminating them. Even
From traditional to alternative approach to storage and analysis of flow data. Petr Velan, Martin Zadnik
From traditional to alternative approach to storage and analysis of flow data Petr Velan, Martin Zadnik Introduction Network flow monitoring Visibility of network traffic Flow analysis and storage enables
An overview of traffic analysis using NetFlow
The LOBSTER project An overview of traffic analysis using NetFlow Arne Øslebø UNINETT Arne.Oslebo@uninett.no 1 Outline What is Netflow? Available tools Collecting Processing Detailed analysis security
Detecting Threats in Network Security by Analyzing Network Packets using Wireshark
1 st International Conference of Recent Trends in Information and Communication Technologies Detecting Threats in Network Security by Analyzing Network Packets using Wireshark Abdulalem Ali *, Arafat Al-Dhaqm,
Data Analysis Load Balancer
Data Analysis Load Balancer Design Document: Version: 1.0 Last saved by Chris Small April 12, 2010 Abstract: The project is to design a mechanism to load balance network traffic over multiple different
INTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs
ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty
Structured Threats 21 External Threats 22 Internal Threats 22 Network Attacks 22 Reconnaissance Attacks 22 Access Attacks 23 Data Retrieval 23 System
xii Contents Structured Threats 21 External Threats 22 Internal Threats 22 Network Attacks 22 Reconnaissance Attacks 22 Access Attacks 23 Data Retrieval 23 System Access 24 Privilege Escalation 24 DoS
Analysis of a DDoS Attack
Analysis of a DDoS Attack December 2014 CONFIDENTIAL CORERO INTERNAL USE ONLY Methodology around DDoS Detection & Mitigation Corero methodology for DDoS protection Initial Configuration Monitoring and
Using Argus to analyse network flows. David Ford OxCERT Oxford University Computer Services
Using Argus to analyse network flows David Ford OxCERT Oxford University Computer Services What are network flows? A convenient way of representing traffic on your network Contain a timestamp, the source/
NetFlow: What is it, why and how to use it? Miloš Zeković, milos.zekovic@soneco.rs. ICmyNet Chief Customer Officer Soneco d.o.o.
NetFlow: What is it, why and how to use it?, milos.zekovic@soneco.rs Soneco d.o.o. Serbia Agenda What is NetFlow? What are the benefits? How to deploy NetFlow? Questions 2 / 22 What is NetFlow? NetFlow
Network Security Monitoring
Network Security Monitoring Network Startup Resource Center www.nsrc.org These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
NetFlow Tracker Overview. Mike McGrath x ccie CTO mike@crannog-software.com
NetFlow Tracker Overview Mike McGrath x ccie CTO mike@crannog-software.com 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK
Internet Management and Measurements Measurements
Internet Management and Measurements Measurements Ramin Sadre, Aiko Pras Design and Analysis of Communication Systems Group University of Twente, 2010 Measurements What is being measured? Why do you measure?
NetFlow FlowAnalyzer Overview
CHAPTER 1 FlowAnalyzer Overview This chapter describes the FlowAnalyzer system and its components. This system is used to read, analyze, and display switching data collected by the FlowCollector application.
The Value of Flow Data for Peering Decisions
The Value of Flow Data for Peering Decisions Hurricane Electric IPv6 Native Backbone Massive Peering! Martin J. Levy Director, IPv6 Strategy Hurricane Electric 22 nd August 2012 Introduction Goal of this
Overview - Using ADAMS With a Firewall
Page 1 of 9 Overview - Using ADAMS With a Firewall Internet security is becoming increasingly important as public and private entities connect their internal networks to the Internet. One of the most popular
Richard Bejtlich richard@taosecurity.com www.taosecurity.com / taosecurity.blogspot.com BSDCan 14 May 04
Network Security Monitoring with Sguil Richard Bejtlich richard@taosecurity.com www.taosecurity.com / taosecurity.blogspot.com BSDCan 14 May 04 Overview Introduction to NSM The competition (ACID, etc.)
Flow Monitor for WhatsUp Gold v16.2 User Guide
Flow Monitor for WhatsUp Gold v16.2 User Guide Contents Table of Contents Flow Monitor Overview Welcome to WhatsUp Gold Flow Monitor... 1 What is Flow Monitor?... 2 How does Flow Monitor work?... 2 System
Network Probe. Figure 1.1 Cacti Utilization Graph
Network Probe Description The MCNC Client Network Engineering group will install several open source network performance management tools on a computer provided by the LEA or charter school to build a
UKCMG Industry Forum November 2006
UKCMG Industry Forum November 2006 Capacity and Performance Management of IP Networks Using IP Flow Measurement Agenda Challenges of capacity and performance management of IP based networks What is IP
What happens when you use nmap or a fuzzer on an ICS?
NSM 101 for ICS About me Chris Sistrunk, PE Electrical Engineer Sr. ICS Security Consultant Control system security assessments ICS Village (DEF CON & RSA Conference) Entergy (11+ years) SCADA Engineer
Netflow Overview. PacNOG 6 Nadi, Fiji
Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools
NetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6
(Integrated) Technology White Paper Issue 01 Date 2012-9-6 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means
Using The Paessler PRTG Traffic Grapher In a Cisco Wide Area Application Services Proof of Concept
Using The Paessler PRTG Traffic Grapher In a Cisco Wide Area Application Services Proof of Concept What You Will Learn Understanding bandwidth traffic and resource consumption is vital to enhanced and
Lab 4.1.2 Characterizing Network Applications
Lab 4.1.2 Characterizing Network Applications Objective Device Designation Device Name Address Subnet Mask Discovery Server Business Services 172.17.1.1 255.255.0.0 R1 FC-CPE-1 Fa0/1 172.17.0.1 Fa0/0 10.0.0.1
Network Metrics Content Pack for VMware vrealize Log Insight
Network Metrics Content Pack for VMware vrealize Log Insight User Manual Version 2.1 June, 2015 Copyright 2012-2015 NetFlow Logic Corporation. All rights reserved. Patents Pending. Contents Introduction...
Intrusion Detection in AlienVault
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Network Monitoring On Large Networks. Yao Chuan Han (TWCERT/CC) james@cert.org.tw
Network Monitoring On Large Networks Yao Chuan Han (TWCERT/CC) james@cert.org.tw 1 Introduction Related Studies Overview SNMP-based Monitoring Tools Packet-Sniffing Monitoring Tools Flow-based Monitoring
Network security Exercise 10 Network monitoring
Network security Exercise 10 Network monitoring Tobias Limmer Computer Networks and Communication Systems Dept. of Computer Sciences, University of Erlangen-Nuremberg, Germany 2. 6.02.2009 Tobias Limmer:
Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document
Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document Produced by AMRES NMS Group (AMRES BPD 104) Author: Ivan Ivanović November 2011 TERENA 2010. All rights reserved.
Edge Configuration Series Reporting Overview
Reporting Edge Configuration Series Reporting Overview The Reporting portion of the Edge appliance provides a number of enhanced network monitoring and reporting capabilities. WAN Reporting Provides detailed
Snort Installation - Ubuntu FEUP. SSI - ProDEI-2010. Paulo Neto and Rui Chilro. December 7, 2010
December 7, 2010 Work Proposal The purpose of this work is: Explain a basic IDS Architecture and Topology Explain a more advanced IDS solution Install SNORT on the FEUP Ubuntu distribution and test some
Policy Based Forwarding
Policy Based Forwarding Tech Note PAN-OS 4.1 Revision A 2012, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Security... 3 Performance... 3 Symmetric Routing... 3 Service Versus
Traffic Monitoring : Experience
Traffic Monitoring : Experience Objectives Lebah Net To understand who and/or what the threats are To understand attacker operation Originating Host Motives (purpose of access) Tools and Techniques Who
Flow Monitor for WhatsUp Gold v16.1 User Guide
Flow Monitor for WhatsUp Gold v16.1 User Guide Contents Table of Contents Flow Monitor Overview Welcome to WhatsUp Gold Flow Monitor... 1 What is Flow Monitor?... 2 How does Flow Monitor work?... 2 System
Network Forensics Network Traffic Analysis
Copyright: The development of this document is funded by Higher Education of Academy. Permission is granted to copy, distribute and /or modify this document under a license compliant with the Creative
PANDORA FMS NETWORK DEVICES MONITORING
NETWORK DEVICES MONITORING pag. 2 INTRODUCTION This document aims to explain how Pandora FMS can monitor all the network devices available in the market, like Routers, Switches, Modems, Access points,
Best of Breed of an ITIL based IT Monitoring. The System Management strategy of NetEye
Best of Breed of an ITIL based IT Monitoring The System Management strategy of NetEye by Georg Kostner 5/11/2012 1 IT Services and IT Service Management IT Services means provisioning of added value for
TITANXR Multi-Switch Management Software
TITANXR Multi-Switch Management Software Centralized management of APCON network monitoring switches Features Centralized APCON system management View status and alerts Configurable Dashboards Monitor
NetFlow Analytics for Splunk
NetFlow Analytics for Splunk User Manual Version 3.5.1 September, 2015 Copyright 2012-2015 NetFlow Logic Corporation. All rights reserved. Patents Pending. Contents Introduction... 3 Overview... 3 Installation...
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
J-Flow on J Series Services Routers and Branch SRX Series Services Gateways
APPLICATION NOTE Juniper Flow Monitoring J-Flow on J Series Services Routers and Branch SRX Series Services Gateways Copyright 2011, Juniper Networks, Inc. 1 APPLICATION NOTE - Juniper Flow Monitoring
Flexible Web Visualization for Alert-Based Network Security Analytics
Flexible Web Visualization for Alert-Based Network Security Analytics Lihua Hao 1, Christopher G. Healey 1, Steve E. Hutchinson 2 1 North Carolina State University, 2 U.S. Army Research Laboratory lhao2@ncsu.edu
Nfsight: NetFlow-based Network Awareness Tool
Nfsight: NetFlow-based Network Awareness Tool Robin Berthier Coordinated Science Laboratory Information Trust Institute University of Illinois Urbana-Champaign, IL, USA rgb@illinois.edu Michel Cukier The
Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1
Smart Tips Enabling WAN Load Balancing Overview Many small businesses today use broadband links such as DSL or Cable, favoring them over the traditional link such as T1/E1 or leased lines because of the
AppSec DC November 13, 2009. The OWASP Foundation http://www.owasp.org. Custom Intrusion Detection Techniques for Monitoring Web Applications
Custom Intrusion Detection Techniques for Monitoring Web Applications AppSec DC November 13, 2009 Matthew Olney Sourcefire VRT molney@sourcefire.com The OWASP Foundation http://www.owasp.org GIVE YOUR
Network Traffic Analysis using HADOOP Architecture. Zeng Shan ISGC2013, Taibei zengshan@ihep.ac.cn
Network Traffic Analysis using HADOOP Architecture Zeng Shan ISGC2013, Taibei zengshan@ihep.ac.cn Flow VS Packet what are netflows? Outlines Flow tools used in the system nprobe nfdump Introduction to
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
How To Identify Different Operating Systems From A Set Of Network Flows
Passive OS detection by monitoring network flows Siebren Mossel University of Twente P.O. Box 217, 7500AE Enschede The Netherlands s.mossel@gmx.net ABSTRACT` Network flow monitoring is a way of monitoring
Configuring Static and Dynamic NAT Simultaneously
Configuring Static and Dynamic NAT Simultaneously Document ID: 13778 Contents Introduction Prerequisites Requirements Components Used Conventions Configuring NAT Related Information Introduction In some
Monitoring Load Balancing in the 10G Arena: Strategies and Requirements for Solving Performance Challenges
2011 is the year of the 10 Gigabit network rollout. These pipes as well as those of existing Gigabit networks, and even faster 40 and 100 Gbps networks are under growing pressure to carry skyrocketing
Monitoring and analyzing audio, video, and multimedia traffic on the network
Monitoring and analyzing audio, video, and multimedia traffic on the network Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia AMRES Academic Network of Serbia RCUB - Belgrade University
Features Overview Guide About new features in WhatsUp Gold v14
Features Overview Guide About new features in WhatsUp Gold v14 Contents New Features in Ipswitch WhatsUp Gold v14 Welcome to WhatsUp Gold v14!... 1 About the Welcome Center About the Quick Setup Assistant...