Protographs: Graph-Based Approach to NetFlow Analysis. Jeff Janies RedJack FloCon 2011
|
|
|
- Collin Ray
- 10 years ago
- Views:
Transcription
1 Protographs: Graph-Based Approach to NetFlow Analysis Jeff Janies RedJack FloCon 2011
2 Thesis Using social networks we can complement our existing volumetric analysis. Identify phenomenon we are missing because they are just not bandwidth heavy enough. Relate behaviors in novel ways. What is really the most important host in a collection a network?
3 Social Network Analysis Demonstrates relationships through Graphs Allows us to map out interconnections. Objective measure of social importance Who connects the groups together? Who can influence communication? 3
4 Protocol Graphs Protocol Graphs Social networks of host communications. (Who talked to whom) Undirected Graphs Vertices The hosts that communicated. Edges Connects between hosts that communicated. Analyze a specific phenomenon. Ex: BotNet, P2P, Established services
5 Protograph Tool Processes raw SiLK NetFlow data. Produces protocol graphs. Only uses IP information. Reports centrality of hosts. Centrality How integral a host is to the group. 5
6 Example NetFlow SIP DIP Sport Dport Flags Bytes Pkts Stime SAF /01/01T SAF /01/01T SAR /01/01T SAR /01/01T SAR /01/01T SAR /01/01T SAR /01/01T SAR /01/01T SAR /01/01T SAR /01/01T.. 6
7 NetFlow as a Protocol Graph That NetFlow Makes this graph. No Volume. No Direction. Just Connections. Centrality Connects many Connects to the rest of the graph. If either removed, the graph is no longer fully connected. 7
8 Centrality A measure of social importance. Betweenness How efficiently a vertex connects the graph. (protograph) Degree How many vertices are connected to the vertex. (SiLK rwuniq) Closeness How close a vertex is to other vertices. Eigenvector How important a vertex is.
9 Betweenness Which hosts provide the most shortest paths through the network? g ij Geodesic paths through host i and j. G ikj Geodesic paths through host k for i and j.
10 Interpretation The higher the centrality value the more "important a host is to the graph. Without a central node the graph will break down into unconnected groups. (The protocol is effected) Example: If we have all a sample of P2P traffic, centrality tells us which host to remove to cause the most damage to the overlay s QoS. Not necessarily which host is the most talkative. 10
11 Volume & Betweenness Spikes in centrality may exist without spikes in bandwidth. Centrality measures something not tied to volume. Sample data: One week long sample of TCP/IP traffic. Ephemeral port to ephemeral port. >1K bytes, >4 packets. Divided into intervals of 60, 30, and 15 minutes.
12 Volume measures
13 Betweenness Centrality
14 Betweenness Centrality Spike 1 Spike 2
15 Volume measures Spike 1 Spike 2
16 Spike 1 3 hosts have 4x the centrality measure of any host measured at any other time. all three part of same phenomenon. One host was a scan victim of two unrelated hosts. The only overlap in scan victims was this host. One scanned ~37,000 destinations on port 20,000. (usermin exploit) One SA scanned ~3,500 destinations. (various ports)
17 Spike 2 1 host has 3x the centrality of any other host measured at any other time. Contacts 20,000 hosts that connect a graph of 31,000 hosts. Active for 6 minutes and sent out 17 million packets. Scanner.
18 Second Data Sample Increased resolution to one minute intervals. One Week of TCP/IP ephemeral port to ephemeral port traffic: >120 bytes per direction. >3 packets. Contains at least a SYN and ACK flag in the OR of observed Flags.
19 Betweenness and Degree Comparing centralities gives richer understanding of hosts relationships. Examine hosts that have high Betweenness with modest Degree. Hosts that are important without being directly connected to many other hosts.
20 Volume Vs. Centralities
21 Only Betweenness Spikes Recorded each IP address max Degree and Betweenness values. Divided spikes, or exceedingly high Betweenness centralities into strata. High (>10,000) - All IP addresses also had comparatively high Degree centrality. Low (>1,000 and <10,000) - We investigated 11 IP addresses that had spikes in Betweenness without comparatively high Degree.
22 High Betweenness Low Degree 9 victims of vulnerability scans. Vulnerability scans requiring full connections. Scanner connects them to a lot of hosts. 1 contacted a host that contacted everything. It provides a service for a promiscuous host. 1 connected several of the hosts with high Degree and Betweenness centrality. Connecting segments of a P2P network. Easily identified high value asset to the P2P network.
23 Summary Social network analysis: Identifying components of a behavior. Complementary tool to volumetric measures. It does not consider direction or volume. Still a great deal of tuning required to make this into an actionable utility. 23
24 References Stephen P. Borgatti, Centrality and Network flow, Social Neworks, Vol. 27, No
Data Fusion Enhancing NetFlow Graph Analytics
Data Fusion Enhancing NetFlow Graph Analytics EMILIE PURVINE, BRYAN OLSEN, CLIFF JOSLYN Pacific Northwest National Laboratory FloCon 2016 Outline Introduction NetFlow Windows Event Log data Remote Desktop
Flow Based Traffic Analysis
Flow based Traffic Analysis Muraleedharan N C-DAC Bangalore Electronics City [email protected] Challenges in Packet level traffic Analysis Network traffic grows in volume and complexity Capture and decode
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
Voice over IP. Demonstration 1: VoIP Protocols. Network Environment
Voice over IP Demonstration 1: VoIP Protocols Network Environment We use two Windows workstations from the production network, both with OpenPhone application (figure 1). The OpenH.323 project has developed
Network Monitoring Using Traffic Dispersion Graphs (TDGs)
Network Monitoring Using Traffic Dispersion Graphs (TDGs) Marios Iliofotou Joint work with: Prashanth Pappu (Cisco), Michalis Faloutsos (UCR), M. Mitzenmacher (Harvard), Sumeet Singh(Cisco) and George
2010 Carnegie Mellon University. Malware and Malicious Traffic
Malware and Malicious Traffic What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working
ACHILLES CERTIFICATION. SIS Module SLS 1508
ACHILLES CERTIFICATION PUBLIC REPORT Final DeltaV Report SIS Module SLS 1508 Disclaimer Wurldtech Security Inc. retains the right to change information in this report without notice. Wurldtech Security
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity
MONITORING OF TRAFFIC OVER THE VICTIM UNDER TCP SYN FLOOD IN A LAN
MONITORING OF TRAFFIC OVER THE VICTIM UNDER TCP SYN FLOOD IN A LAN Kanika 1, Renuka Goyal 2, Gurmeet Kaur 3 1 M.Tech Scholar, Computer Science and Technology, Central University of Punjab, Punjab, India
DDoS Protecion Total AnnihilationD. DDoS Mitigation Lab
DDoS Protecion Total AnnihilationD A Industry body formed to foster synergy among stakeholders to promote advancement in DDoS defense knowledge. Independent academic R&D division of Nexusguard building
Applied Detection and Analysis Using Network Flow Data
Applied Detection and Analysis Using Network Flow Data Chris Sanders and Jason Smith TAP Intel-Based Detection Mandiant, a FireEye Company Chris Sanders Christian & Husband Kentuckian and South Carolinian
Plugging Network Security Holes using NetFlow. Loopholes in todays network security solutions and how NetFlow can help
Plugging Network Security Holes using NetFlow Loopholes in todays network security solutions and how NetFlow can help About ManageEngine Network Servers & Applications Desktop ServiceDesk Windows Infrastructure
Nemea: Searching for Botnet Footprints
Nemea: Searching for Botnet Footprints Tomas Cejka 1, Radoslav Bodó 1, Hana Kubatova 2 1 CESNET, a.l.e. 2 FIT, CTU in Prague Zikova 4, 160 00 Prague 6 Thakurova 9, 160 00 Prague 6 Czech Republic Czech
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection
INCREASE NETWORK VISIBILITY AND REDUCE SECURITY THREATS WITH IMC FLOW ANALYSIS TOOLS
WHITE PAPER INCREASE NETWORK VISIBILITY AND REDUCE SECURITY THREATS WITH IMC FLOW ANALYSIS TOOLS Network administrators and security teams can gain valuable insight into network health in real-time by
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
Analysis of Network Beaconing Activity for Incident Response
Analysis of Network Beaconing Activity for Incident Response FloCon2008 Peter Balland, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department of Energy by under
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
Communication Systems Internetworking (Bridges & Co)
Communication Systems Internetworking (Bridges & Co) Prof. Dr.-Ing. Lars Wolf TU Braunschweig Institut für Betriebssysteme und Rechnerverbund Mühlenpfordtstraße 23, 38106 Braunschweig, Germany Email: [email protected]
NSC 93-2213-E-110-045
NSC93-2213-E-110-045 2004 8 1 2005 731 94 830 Introduction 1 Nowadays the Internet has become an important part of people s daily life. People receive emails, surf the web sites, and chat with friends
Chapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
Edge Configuration Series Reporting Overview
Reporting Edge Configuration Series Reporting Overview The Reporting portion of the Edge appliance provides a number of enhanced network monitoring and reporting capabilities. WAN Reporting Provides detailed
Project 4: (E)DoS Attacks
Project4 EDoS Instructions 1 Project 4: (E)DoS Attacks Secure Systems and Applications 2009 Ben Smeets (C) Dept. of Electrical and Information Technology, Lund University, Sweden Introduction A particular
Analysis of a DDoS Attack
Analysis of a DDoS Attack December 2014 CONFIDENTIAL CORERO INTERNAL USE ONLY Methodology around DDoS Detection & Mitigation Corero methodology for DDoS protection Initial Configuration Monitoring and
Data Sheet. V-Net Link 700 C Series Link Load Balancer. V-NetLink:Link Load Balancing Solution from VIAEDGE
Data Sheet V-Net Link 700 C Series Link Load Balancer V-NetLink:Link Load Balancing Solution from VIAEDGE V-NetLink : Link Load Balancer As the use of the Internet to deliver organizations applications
Seminar Computer Security
Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example
TDC s perspective on DDoS threats
TDC s perspective on DDoS threats DDoS Dagen Stockholm March 2013 Lars Højberg, Technical Security Manager, TDC TDC in Sweden TDC in the Nordics 9 300 employees (2012) Turnover: 26,1 billion DKK (2012)
Main functions of Linux Netfilter
Main functions of Linux Netfilter Filter Nat Packet filtering (rejecting, dropping or accepting packets) Network Address Translation including DNAT, SNAT and Masquerading Mangle General packet header modification
Design and Implementation of an Interactive DBMS-supported Network Traffic Analysis and Visualization System
Design and Implementation of an Interactive DBMS-supported Network Traffic Analysis and Visualization System 1 Hyun-chul Kim, 2Jihoon Lee Dept. of Computer Software Engineering, Sangmyung Univ., [email protected]
Packet Sniffing on Layer 2 Switched Local Area Networks
Packet Sniffing on Layer 2 Switched Local Area Networks Ryan Spangler [email protected] Packetwatch Research http://www.packetwatch.net December 2003 Abstract Packet sniffing is a technique of monitoring
Cisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
Security Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
LIST OF FIGURES. Figure No. Caption Page No.
LIST OF FIGURES Figure No. Caption Page No. Figure 1.1 A Cellular Network.. 2 Figure 1.2 A Mobile Ad hoc Network... 2 Figure 1.3 Classifications of Threats. 10 Figure 1.4 Classification of Different QoS
CYBER ATTACKS EXPLAINED: PACKET CRAFTING
CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure
Analysis of Network Packets. C DAC Bangalore Electronics City
Analysis of Network Packets C DAC Bangalore Electronics City Agenda TCP/IP Protocol Security concerns related to Protocols Packet Analysis Signature based Analysis Anomaly based Analysis Traffic Analysis
Safeguards Against Denial of Service Attacks for IP Phones
W H I T E P A P E R Denial of Service (DoS) attacks on computers and infrastructure communications systems have been reported for a number of years, but the accelerated deployment of Voice over IP (VoIP)
NetFlow use cases. ICmyNet / NetVizura. Miloš Zeković, [email protected]. ICmyNet Chief Customer Officer Soneco d.o.o.
NetFlow use cases ICmyNet / NetVizura, [email protected] Soneco d.o.o. Serbia Agenda ICmyNet / NetVizura overview Use cases / case studies Statistics per exporter/interfaces Traffic Patterns NREN
Cloud Networking Disruption with Software Defined Network Virtualization. Ali Khayam
Cloud Networking Disruption with Software Defined Network Virtualization Ali Khayam In the next one hour Let s discuss two disruptive new paradigms in the world of networking: Network Virtualization Software
Question: 3 When using Application Intelligence, Server Time may be defined as.
1 Network General - 1T6-521 Application Performance Analysis and Troubleshooting Question: 1 One component in an application turn is. A. Server response time B. Network process time C. Application response
Characteristics of Network Traffic Flow Anomalies
Characteristics of Network Traffic Flow Anomalies Paul Barford and David Plonka I. INTRODUCTION One of the primary tasks of network administrators is monitoring routers and switches for anomalous traffic
Troubleshooting Tips and Tricks
Troubleshooting Tips and Tricks for TCP/IP Networks June 16, 2011 Laura Chappell Founder Chappell University/Wireshark University [email protected] SHARKFEST 11 Stanford University June 13 16, 2011 The
CS 457 Lecture 19 Global Internet - BGP. Fall 2011
CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with
Transport and Network Layer
Transport and Network Layer 1 Introduction Responsible for moving messages from end-to-end in a network Closely tied together TCP/IP: most commonly used protocol o Used in Internet o Compatible with a
Firewall Implementation
CS425: Computer Networks Firewall Implementation Ankit Kumar Y8088 Akshay Mittal Y8056 Ashish Gupta Y8410 Sayandeep Ghosh Y8465 October 31, 2010 under the guidance of Prof. Dheeraj Sanghi Department of
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
Flow Visualization Using MS-Excel
Flow Visualization Using MS-Excel Visualization for the Common Man Presented by Lee Rock and Jay Brown US-CERT Analysts Einstein Program Background US-CERT Mission Einstein Program > Large volumes of traffic
More Netflow Tools: For Performance and Security
More Netflow Tools: For Performance and Security Carrie Gates, Michael Collins, Michael Duggan, Andrew Kompanek and Mark Thomas Carnegie Mellon University ABSTRACT Analysis of network traffic is becoming
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior
Investigation and Comparison of MPLS QoS Solution and Differentiated Services QoS Solutions
Investigation and Comparison of MPLS QoS Solution and Differentiated Services QoS Solutions Steve Gennaoui, Jianhua Yin, Samuel Swinton, and * Vasil Hnatyshin Department of Computer Science Rowan University
Configuring Security for FTP Traffic
2 Configuring Security for FTP Traffic Securing FTP traffic Creating a security profile for FTP traffic Configuring a local traffic FTP profile Assigning an FTP security profile to a local traffic FTP
Detecting Botnets with NetFlow
Detecting Botnets with NetFlow V. Krmíček, T. Plesník {vojtec plesnik}@ics.muni.cz FloCon 2011, January 12, Salt Lake City, Utah Presentation Outline NetFlow Monitoring at MU Chuck Norris Botnet in a Nutshell
QoS (Quality of Service)
QoS (Quality of Service) QoS function helps you to control your network traffic for each application from LAN (Ethernet and/or Wireless) to WAN (Internet). It facilitates you to control the different quality
Network Visibility Guide
Network Visibility Guide Even Superman could only see through walls, not networks! We understand your lack of Network visibility. So we give you ManageEngine NetFlow Analyzer! Network visibility is the
Denial of Service Attacks
2 Denial of Service Attacks : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013 its335y13s2l06, Steve/Courses/2013/s2/its335/lectures/malicious.tex,
Datagram-based network layer: forwarding; routing. Additional function of VCbased network layer: call setup.
CEN 007C Computer Networks Fundamentals Instructor: Prof. A. Helmy Homework : Network Layer Assigned: Nov. 28 th, 2011. Due Date: Dec 8 th, 2011 (to the TA) 1. ( points) What are the 2 most important network-layer
Attack and Defense Techniques 2
Network Security Attack and Defense Techniques 2 Anna Sperotto, Ramin Sadre Design and Analysis of ommunication Networks (DAS) University of Twente The Netherlands Firewalls Network firewall Internet 25
Network Security. Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT)
Network Security ICMP, TCP, DNS, Scanning Marcus Bendtsen Institutionen för Datavetenskap (IDA) Avdelningen för Databas- och Informationsteknik (ADIT) Agenda A couple of examples of network protocols that
Overview of Network Traffic Analysis
Overview of Network Traffic Analysis Network Traffic Analysis identifies which users or applications are generating traffic on your network and how much network bandwidth they are consuming. For example,
Network Security: Workshop. Dr. Anat Bremler-Barr. Assignment #2 Analyze dump files Solution Taken from www.chrissanders.org
1.pcap - File download Network Security: Workshop Dr. Anat Bremler-Barr Assignment #2 Analyze dump files Solution Taken from www.chrissanders.org Downloading a file is a pretty basic function when described
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Firewall Defaults and Some Basic Rules
Firewall Defaults and Some Basic Rules ProSecure UTM Quick Start Guide This quick start guide provides the firewall defaults and explains how to configure some basic firewall rules for the ProSecure Unified
Network Layer. Introduction Datagrams and Virtual Circuits Routing Traffic Control. Data delivery from source to destination.
Layer Introduction Datagrams and Virtual ircuits Routing Traffic ontrol Main Objective Data delivery from source to destination Node (Router) Application Presentation Session Transport Data Link Data Link
Research on Errors of Utilized Bandwidth Measured by NetFlow
Research on s of Utilized Bandwidth Measured by NetFlow Haiting Zhu 1, Xiaoguo Zhang 1,2, Wei Ding 1 1 School of Computer Science and Engineering, Southeast University, Nanjing 211189, China 2 Electronic
Network Security in Practice
Network Security in Practice Practices of Network Security ccess control: firewalls ttacks and counter measures Security protocol case studies Kai Shen 12/8/2014 CSC 257/457 - Fall 2014 1 12/8/2014 CSC
Performance of networks containing both MaxNet and SumNet links
Performance of networks containing both MaxNet and SumNet links Lachlan L. H. Andrew and Bartek P. Wydrowski Abstract Both MaxNet and SumNet are distributed congestion control architectures suitable for
How To Prevent DoS and DDoS Attacks using Cyberoam
How To Prevent DoS and DDoS Attacks using Cyberoam How To Prevent DoS and DDoS Attacks using Cyberoam Applicable Version: 10.00 onwards Overview Denial of Service (DoS) A Denial of Service (DoS) attack
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA
Viete, čo robia Vaši užívatelia na sieti? Roman Tuchyňa, CSA What is ReporterAnalyzer? ReporterAnalyzer gives network professionals insight into how application traffic is impacting network performance.
Chapter 28 Denial of Service (DoS) Attack Prevention
Chapter 28 Denial of Service (DoS) Attack Prevention Introduction... 28-2 Overview of Denial of Service Attacks... 28-2 IP Options... 28-2 LAND Attack... 28-3 Ping of Death Attack... 28-4 Smurf Attack...
Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol
Mobile IP Network Layer Lesson 02 TCP/IP Suite and IP Protocol 1 TCP/IP protocol suite A suite of protocols for networking for the Internet Transmission control protocol (TCP) or User Datagram protocol
Outline. Outline. Outline
Network Forensics: Network Prefix Scott Hand September 30 th, 2011 1 What is network forensics? 2 What areas will we focus on today? Basics Some Techniques What is it? OS fingerprinting aims to gather
DoS/DDoS Attacks and Protection on VoIP/UC
DoS/DDoS Attacks and Protection on VoIP/UC Presented by: Sipera Systems Agenda What are DoS and DDoS Attacks? VoIP/UC is different Impact of DoS attacks on VoIP Protection techniques 2 UC Security Requirements
Brocade NetIron Denial of Service Prevention
White Paper Brocade NetIron Denial of Service Prevention This white paper documents the best practices for Denial of Service Attack Prevention on Brocade NetIron platforms. Table of Contents Brocade NetIron
The changing face of global data network traffic
The changing face of global data network traffic Around the turn of the 21st century, MPLS very rapidly became the networking protocol of choice for large national and international institutions. This
Sample Network Analysis Report
Sample Network Analysis Report Report Information Report created on 1/9/2014 9:35:19 PM. Analyst Information Name Sample Analysis Report E-mail Address [email protected] Phone Number 408-378-7841 Client
nfdump and NfSen 18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH
18 th Annual FIRST Conference June 25-30, 2006 Baltimore Peter Haag 2006 SWITCH Some operational questions, popping up now and then: Do you see this peek on port 445 as well? What caused this peek on your
I3: Maximizing Packet Capture Performance. Andrew Brown
I3: Maximizing Packet Capture Performance Andrew Brown Agenda Why do captures drop packets, how can you tell? Software considerations Hardware considerations Potential hardware improvements Test configurations/parameters
Port evolution: a software to find the shady IP profiles in Netflow. Or how to reduce Netflow records efficiently.
TLP:WHITE - Port Evolution Port evolution: a software to find the shady IP profiles in Netflow. Or how to reduce Netflow records efficiently. Gerard Wagener 41, avenue de la Gare L-1611 Luxembourg Grand-Duchy
Communication Networks. MAP-TELE 2011/12 José Ruela
Communication Networks MAP-TELE 2011/12 José Ruela Network basic mechanisms Introduction to Communications Networks Communications networks Communications networks are used to transport information (data)
Network Performance Monitoring at Minimal Capex
Network Performance Monitoring at Minimal Capex Some Cisco IOS technologies you can use to create a high performance network Don Thomas Jacob Technical Marketing Engineer About ManageEngine Network Servers
An apparatus for P2P classification in Netflow traces
An apparatus for P2P classification in Netflow traces Andrew M Gossett, Ioannis Papapanagiotou and Michael Devetsikiotis Electrical and Computer Engineering, North Carolina State University, Raleigh, USA
Introduction to Network Traffic Monitoring. Evangelos Markatos. FORTH-ICS [email protected]
Introduction to Network Traffic Monitoring -ICS [email protected] http://www.ics.forth.gr/~markatos Institute of Computer Science (ICS) Foundation for Research and Technology Hellas () Roadmap Motivation
Lab 3: Recon and Firewalls
Lab 3: Recon and Firewalls IP, UDP, TCP and ICMP Before we can create firewall rules, we have to know the basics of network protocols. Here's a quick review... IP ICMP UDP TCP The underlying packet delivery
How to protect your home/office network?
How to protect your home/office network? Using IPTables and Building a Firewall - Background, Motivation and Concepts Adir Abraham [email protected] Do you think that you are alone, connected from
Overview of TCP/IP. TCP/IP and Internet
Overview of TCP/IP System Administrators and network administrators Why networking - communication Why TCP/IP Provides interoperable communications between all types of hardware and all kinds of operating
Maximize Network Visibility with NetFlow Technology. Andy Wilson Senior Systems Engineer Lancope
Maximize Network Visibility with NetFlow Technology Andy Wilson Senior Systems Engineer Lancope Agenda What is NetFlow Introduction to NetFlow NetFlow Examples NetFlow in Action Network Operations User
Ranch Networks for Hosted Data Centers
Ranch Networks for Hosted Data Centers Internet Zone RN20 Server Farm DNS Zone DNS Server Farm FTP Zone FTP Server Farm Customer 1 Customer 2 L2 Switch Customer 3 Customer 4 Customer 5 Customer 6 Ranch
A SOCIAL NETWORK ANALYSIS APPROACH TO ANALYZE ROAD NETWORKS INTRODUCTION
A SOCIAL NETWORK ANALYSIS APPROACH TO ANALYZE ROAD NETWORKS Kyoungjin Park Alper Yilmaz Photogrammetric and Computer Vision Lab Ohio State University [email protected] [email protected] ABSTRACT Depending
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
Fuzzy Network Profiling for Intrusion Detection
Fuzzy Network Profiling for Intrusion Detection John E. Dickerson ([email protected]) and Julie A. Dickerson ([email protected]) Electrical and Computer Engineering Department Iowa State University
How Much Broadcast and Multicast Traffic Should I Allow in My Network?
PowerConnect Application Note #5 November 2003 How Much Broadcast and Multicast Traffic Should I Allow in My Network? This Application Note relates to the following Dell PowerConnect products: PowerConnect
Ethernet. Ethernet. Network Devices
Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking