Covert channel detection using flow-data
|
|
|
- Byron Davidson
- 6 years ago
- Views:
Transcription
1 Covert channel detection using flow-data Guido Pineda Reyes MSc. Systems and Networking Engineering University of Amsterdam July 3, 2014 Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
2 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
3 Covert Channels Definition Lampson, A communication channel that is used for information transmission, but that is not intended for communications... National Computer Security Centre Maryland Meade, 1985 Communication channel that can be exploited... to transfer information in a manner that violates the system s security policy Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
4 Malicious usage Data exfiltration Intrusion maintenance Botnet control Malware updates Gathering of sensitive information... Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
5 Chosen techniques ICMP tunnel ICMP reverse shell DNS tunnel HTTP reverse shell Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
6 Flow-data Overview Netflow is a monitoring tool Describes the method for a collector to export statistics about IP packets passing an observation point. Netflow v10 aka IPFIX (RFC 5101) Payload is not included Flow Packets with a set of common properties: source address and port number ingress interface destination address and port number network layer protocol type of service (TOS) Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
7 Research questions Is it possible to detect network-based covert channel malicious activity by using flow-data? How do the selected covert channel techniques work? What is the difference between normal traffic and covert channel traffic behaviour using the chosen techniques? What algorithms can be used to detect network-based covert channel traffic? How can this results be validated? Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
8 Approach Data gathering Regular traffic Protocol Total bytes (MB) Total packets Total bidirectional flows ICMP DNS HTTP Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
9 Approach Data gathering Malicious traffic Technique Total bytes (MB) Total packets Total bidirectional flows ICMP tunneling ICMP reverse shell DNS tunneling HTTP reverse shell Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
10 Approach Experimental environment Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
11 IPFIX templates Export template: ICMP Field IPV4 SRC ADDR IPV4 DST ADDR PROTOCOL IN BYTES IN PKTS OUT BYTES OUT PKTS MIN TTL MAX TTL ICMP TYPE Description IPv4 source address IPv4 destination address IP protocol byte Incoming flow bytes (src ->dst) Incoming flow packets (src ->dst) Outgoing flow bytes (dst ->src) Outgoing flow packets (dst ->src) Min flow TTL Max flow TTL ICMP Type * ICMP code Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
12 IPFIX templates Export template: DNS Field IPV4 SRC ADDR IPV4 DST ADDR PROTOCOL IN BYTES IN PKTS OUT BYTES OUT PKTS MIN TTL MAX TTL DNS QUERY DNS QUERY ID DNS QUERY TYPE DNS RET CODE Description IPv4 source address IPv4 destination address IP protocol byte Incoming flow bytes (src ->dst) Incoming flow packets (src ->dst) Outgoing flow bytes (dst ->src) Outgoing flow packets (dst ->src) Min flow TTL Max flow TTL DNS query DNS query transaction Id DNS query type (e.g. 1=A, 2=NS..) DNS return code (e.g. 0=no error) Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
13 IPFIX templates Export template: HTTP Field Description IPV4 SRC ADDR IPv4 source address IPV4 DST ADDR IPv4 destination address PROTOCOL IP protocol byte IN BYTES Incoming flow bytes (src->dst) IN PKTS Incoming flow packets (src->dst) OUT BYTES Outgoing flow bytes (dst->src) OUT PKTS Outgoing flow packets (dst->src) MIN TTL Min flow TTL MAX TTL Max flow TTL TCP FLAGS Cumulative of all flow TCP flags HTTP URL HTTP URL HTTP METHOD HTTP METHOD HTTP RET CODE HTTP return code (e.g. 200, ) Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
14 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
15 ICMP tunnel Packet ratio distribution Regular ICMP ICMP tunnel Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
16 ICMP tunnel Bytes per packet distribution Regular ICMP ICMP tunnel Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
17 ICMP reverse shell TTL distribution Regular ICMP ICMP reverse shell Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
18 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
19 DNS tunnel Packet ratio distribution Regular DNS DNS tunnel Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
20 Regular DNS Packet distribution per unique destination IP Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
21 DNS tunnel Packet distribution per unique destination IP Destination IP A Destination IP B Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
22 DNS tunnel Packet distribution per unique destination IP Destination IP C (Tunnel server) Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
23 Regular DNS DNS QUERY TYPE analysis DNS QUERY TYPE # of flows % Type A NS SOA PTR TXT AAAA SRV DS DNSKEY Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
24 DNS tunnel DNS QUERY TYPE analysis DNS QUERY TYPE # of flows % Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
25 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
26 HTTP TCP FLAGS analysis Cumulative OR-ed of TCP FLAGS for all packets in one flow. For regular HTTP traffic, this value is well distributed. But, for malicious HTTP traffic, every flow has the TCP FLAGS value = 27 Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
27 Regular HTTP TCP FLAGS analysis TCP FLAG # of flows Meaning % ACK+PUSH 55, ACK+PUSH+SYN 25, ACK+PUSH+SYN+FIN 12, ACK+FIN+SYN 5, ACK+FIN 0, ACK+PUSH+RST+SYN+FIN 0, ACK+PUSH+RST+SYN 0, ACK+RST+SYN+FIN 0, ACK+PSH+FIN 0, ACK+RST+FIN 0, ACK+SYN 0,0025 Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
28 HTTP HTTP METHOD analysis per unique destination IP Destination IP address # of Flows with method: GET POST HEAD EMPTY A B C D E F G H I J Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
29 HTTP HTTP METHOD analysis per unique destination IP For HTTP reverse shell traffic, the amount of POST and GET methods per unique destination IP address is about 50% each. Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
30 Algorithms Description Using a data-set provided by the sponsoring company. HTTP traffic generated by 150 different web crawlers (64095 flows) DNS traffic (35219 flows) ICMP traffic (12352 flows) Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
31 Proposed alorithms ICMP Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
32 Proposed alorithms DNS Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
33 Proposed alorithms HTTP Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
34 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
35 ICMP Tunnel Before injection After injection Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
36 ICMP ICMP reverse shell Before injection After injection Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
37 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
38 DNS DNS tunnel Analysis on the packet distribution per unique destination IP address shows suspicious standard deviation values for specific flows. DNS QUERY TYPE field is effective to retrieve unusual values. Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
39 Outline 1 Introduction 2 Research questions 3 Approach 4 Data analysis ICMP DNS HTTP 5 Algorithms 6 Implementation ICMP DNS HTTP 7 Conclusions 8 Q&A Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
40 HTTP HTTP reverse shell After filtering every flow with TCP FLAGS field = 27 Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
41 HTTP HTTP reverse shell Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
42 HTTP HTTP reverse shell Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
43 Conclusions It is possible to detect the tested network-based covert channels by using flow data. By establishing a base line behaviour, it is possible to compare between regular and suspicious behavior. Even though, flow-data does not give an insight on the payload of a packet, is still a powerful tool for security analysis. Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
44 Future work Implement the proposed algorithms as a script or programming language and with live flow-data Test more tools for similar behaviour patterns Test other protocols Test a bigger data-set for possible false positives Compare results with other types of malicious traffic Investigate flow-data with network-based covert timing channels Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
45 Q&A Questions? Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
46 Appendix Covert Channel Classification Covert Storage Channel Carries information inside protocol fields Covert Timing Channel They use time emission between packets. A time interval can be defined: if a packet is sent during the interval, this codes a one, if no packet is sent this codes a zero. Guido Pineda Reyes (UvA) Covert channel detection using flow-data July 3, / 46
Enhancing Network Security: Host Trustworthiness Estimation
Enhancing Network Security: Host Trustworthiness Estimation Tomáš Jirsík, Pavel Čeleda {jirsik celeda}@ics.muni.cz Institute of Computer Science, Masaryk University Goal 25,739% Tomáš Jirsík, Pavel Čeleda
Monitoring and diagnostics of data infrastructure problems in power engineering. Jaroslav Stusak, Sales Director CEE, Flowmon Networks
Monitoring and diagnostics of data infrastructure problems in power engineering Jaroslav Stusak, Sales Director CEE, Flowmon Networks 35,000 kilometers of electric power, which feeds around 740,000 clients...
Listening to the Network: Leveraging Network Flow Telemetry for Security Applications Darren Anstee EMEA Solutions Architect
Listening to the Network: Leveraging Network Flow Telemetry for Security Applications Darren Anstee EMEA Solutions Architect Introduction Security has an increased focus from ALL businesses, whether they
Flow Measurement. For IT, Security and IoT/ICS. Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018
Flow Measurement For IT, Security and IoT/ICS Pavel Minařík, Chief Technology Officer EMITEC, Swiss Test and Measurement Day 20 th April 2018 What is Flow Data? Modern method for network monitoring flow
Network Management & Monitoring
Network Management & Monitoring NfSen These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) What is NfSen
Experiences with IPFIX-based Traffic Measurement for IPv6 Networks. Nakjung Choi, Hyeongu Son*, Youngseok Lee* and Yanghee Choi
Experiences with IPFIX-based Traffic Measurement for IPv6 Networks Nakjung Choi, Hyeongu Son*, Youngseok Lee* and Yanghee Choi Seoul National Univ *Chungnam National Univ 27. 8. 31 (Fri) SIGCOMM 27 IPv6
Monitoring and Threat Detection
Monitoring and Threat Detection with Netflow Michael Belan Consulting Systems Engineer Cisco GSSO January 2017 AGENDA What is SW? Where does it fit in overall Cisco Security framework? What is SW? What
Managing Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
Zone-Based Firewall Logging Export Using NetFlow
Zone-Based Firewall Logging Export Using NetFlow Zone-based firewalls support the logging of messages to an external collector using NetFlow Version 9 export format. NetFlow Version 9 export format uses
DNS Type Query Support Added to the DNS Analyzer
DNS Type Query Support Added to the DNS Analyzer This chapter describes the following topics: Feature Summary and Revision History, page 1 Feature Changes, page 2 Command Changes, page 4 Performance Indicator
Master Course Computer Networks IN2097
Chair for Network Architectures and Services Prof. Carle Department for Computer Science TU München Master Course Computer Networks IN2097 Chapter 7 - Network Measurements Introduction Architecture & Mechanisms
Introduction to Netflow
Introduction to Netflow Campus Network Design & Operations Workshop These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
Cisco Stealthwatch. Internal Alarm IDs 7.0
Cisco Stealthwatch Internal Alarm IDs 7.0 Stealthwatch Internal Alarm IDs Some previously used alarms are now obsolete and no longer listed in this file. 1 Host Lock Violation 5 SYN Flood 6 UDP Flood 7
Network Management and Monitoring
Network Management and Monitoring Introduction to Netflow These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
AVC Configuration. Unified Policy CLI CHAPTER
CHAPTER 3 Revised: February 7, 2013, This chapter addresses AVC configuration and includes the following topics: Unified Policy CLI, page 3-1 Metric Producer Parameters, page 3-2 Reacts, page 3-2 NetFlow/IPFIX
This chapter provides information to configure Cflowd.
Cflowd In This Chapter This chapter provides information to configure Cflowd. Topics in this chapter include: Cflowd Overview on page 564 Operation on page 565 Cflowd Filter Matching on page 569 Cflowd
Master Course Computer Networks IN2097
Chair for Network Architectures and Services Prof. Carle Department for Computer Science TU München Master Course Computer Networks IN2097 Prof. Dr.-Ing. Georg Carle Christian Grothoff, Ph.D. Dr. Nils
NetFlow-based bandwidth estimation in IP networks
NetFlow-based bandwidth estimation in IP networks Rodrigo Alarcón-Reyes Department of Electrical and Computer Engineering McGill University March 3, 22 Outline. Introduction to NetFlow 2. Definition of
Peer-to-Peer Botnet Detection Using NetFlow. Connor Dillon
Peer-to-Peer Botnet Detection Using NetFlow Connor Dillon System and Network Engineering University of Amsterdam Master thesis presentation, July 3 rd 2014 Supervisor: Pepijn Janssen RedSocks Botnets Large
Configuring NetFlow and NetFlow Data Export
This module contains information about and instructions for configuring NetFlow to capture and export network traffic data. NetFlow capture and export are performed independently on each internetworking
Gigamon Metadata Application for IBM QRadar Deployment Guide
Gigamon Metadata Application for IBM QRadar Deployment Guide COPYRIGHT Copyright 2018 Gigamon. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a
Packet Header Formats
A P P E N D I X C Packet Header Formats S nort rules use the protocol type field to distinguish among different protocols. Different header parts in packets are used to determine the type of protocol used
Configuring NetFlow. Information About NetFlow. What is a Flow. This chapter contains the following sections:
This chapter contains the following sections: Information About NetFlow, page 1 Guidelines and Limitations for NetFlow, page 9 Default Settings for NetFlow, page 10 Enabling the NetFlow Feature, page 11
KUPF: 2-Phase Selection Model of Classification Records
KUPF: 2-Phase Selection Model of Classification Records KAKIUCHI Masatoshi Nara Institute of Science and Technology Background Many Internet services classify the data to be handled according to rules
ASA Access Control. Section 3
[ 39 ] CCNP Security Firewall 642-617 Quick Reference Section 3 ASA Access Control Now that you have connectivity to the ASA and have configured basic networking settings on the ASA, you can start to look
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
History Page. Barracuda NextGen Firewall F
The Firewall > History page is very useful for troubleshooting. It provides information for all traffic that has passed through the Barracuda NG Firewall. It also provides messages that state why traffic
Distributed Systems. 27. Firewalls and Virtual Private Networks Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 27. Firewalls and Virtual Private Networks Paul Krzyzanowski Rutgers University Fall 2013 November 25, 2013 2013 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive
Monitoring the Device
The system includes dashboards and an Event Viewer that you can use to monitor the device and traffic that is passing through the device. Enable Logging to Obtain Traffic Statistics, page 1 Monitoring
NAT Command Reference
Command Reference Command Hierarchies ISA Configuration Commands on page 639 NAT Service Configuration Commands on page 640 VPRN Commands on page 643 NAT Subscriber Management Commands on page 645 NAT
Flexible NetFlow - Top N Talkers Support
This document contains information about and instructions for using the Flexible NetFlow - Top N Talkers Support feature. The feature helps you analyze the large amount of data that Flexible NetFlow captures
NETWORK PACKET ANALYSIS PROGRAM
NETWORK PACKET ANALYSIS PROGRAM Duration: 3 days (21 hours) Mode: 1. Instructor Led Class room Training and Labs 2. Online In this hands-on course, you will receive in-depth training on Protocol analysis
plixer Scrutinizer Competitor Worksheet Visualization of Network Health Unauthorized application deployments Detect DNS communication tunnels
Scrutinizer Competitor Worksheet Scrutinizer Malware Incident Response Scrutinizer is a massively scalable, distributed flow collection system that provides a single interface for all traffic related to
Using NetFlow Sampling to Select the Network Traffic to Track
Using NetFlow Sampling to Select the Network Traffic to Track This module contains information about and instructions for selecting the network traffic to track through the use of NetFlow sampling. The
Network Processors. Nevin Heintze Agere Systems
Network Processors Nevin Heintze Agere Systems Network Processors What are the packaging challenges for NPs? Caveat: I know very little about packaging. Network Processors What are the packaging challenges
Configuring Application Visibility and Control for Cisco Flexible Netflow
Configuring Application Visibility and Control for Cisco Flexible Netflow First published: July 22, 2011 This guide contains information about the Cisco Application Visibility and Control feature. It also
IPSec. Overview. Overview. Levente Buttyán
IPSec - brief overview - security associations (SAs) - Authentication Header (AH) protocol - Encapsulated Security Payload () protocol - combining SAs (examples) Overview Overview IPSec is an Internet
Configuring Data Export for Flexible NetFlow with Flow Exporters
Configuring Data Export for Flexible NetFlow with Flow Exporters Last Updated: November 29, 2012 This document contains information about and instructions for configuring flow exporters to export Flexible
Network Element Configuration
The following describes how to configure Flexible NetFlow and NTP servers on your ISR. Configuring a Network Element, page 1 NTP Configuration, page 1 NetFlow Configuration, page 2 Configuring a Network
Juniper Netscreen Security Device. How to Enable IPv6 Page-51
Juniper Netscreen Security Device Page-51 Netscreen Firewall - Interfaces Below is a screen shot for a Netscreen Firewall interface. All interfaces have an IPv6 address except ethernet0/0. We will step
Network Security Monitoring with Flow Data
Network Security Monitoring with Flow Data IT Monitoring in Enterprises NPMD (Network Performance Monitoring & Diagnostics) SNMP basics Flow data for advanced analysis and troubleshooting Packet capture
Intelligent WAN NetFlow Monitoring Deployment Guide
Cisco Validated design Intelligent WAN NetFlow Monitoring Deployment Guide September 2017 Table of Contents Table of Contents Deploying the Cisco Intelligent WAN... 1 Deployment Details...1 Deploying NetFlow
How the Internet sees you
IBM Research Zurich How the Internet sees you Demonstrating what activities most ISPs see you doing on the Internet Jeroen Massar 2010 IBM Corporation Network of networks You 2 CCC
DNS Anomaly Detection
DNS Anomaly Detection superdad Nick Barendregt Hidde van der Heide Agenda Introduction Methods Results Conclusion Questions and Discussion 3 / 25 Introduction "Examine the feasibility of detecting malware
Intrusion Detection and Malware Analysis
Intrusion Detection and Malware Analysis Anomaly-based IDS Pavel Laskov Wilhelm Schickard Institute for Computer Science Taxonomy of anomaly-based IDS Features: Packet headers Byte streams Syntactic events
Large-Scale Geolocation for NetFlow
Large-Scale Geolocation for NetFlow Pavel Čeleda, Petr Velan, Martin Rábek Rick Hofstede, Aiko Pras {celeda velan xrabek1}@ics.muni.cz, {r.j.hofstede a.pras}@utwente.nl IFIP/IEEE IM 2013, 27-31 May 2013,
Cisco Day Hotel Mons Wednesday
Cisco Day 2016 20.4.2016 Hotel Mons Wednesday Three Friends in Security : Identity, Visibility and Enforcement Stop the bad guys immediately György Ács IT Security Consulting Systems Engineer 20 April
Mohammad Hossein Manshaei 1393
Mohammad Hossein Manshaei manshaei@gmail.com 1393 Mobile IP 2 Mobile Network Layer: Problems and Concerns Entities and Terminology in Mobile IP Mobile Indirect Routing Mobile IP Agent Advertisement Registration
Distributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 19: Intrusion Detection Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Intruders Intrusion detection host-based network-based
Configuring Flexible NetFlow
Prerequisites for Flexible NetFlow, on page 1 Restrictions for Flexible NetFlow, on page 2 Information About Flexible Netflow, on page 4 How to Configure Flexible Netflow, on page 18 Monitoring Flexible
Internet. 1) Internet basic technology (overview) 3) Quality of Service (QoS) aspects
Internet 1) Internet basic technology (overview) 2) Mobility aspects 3) Quality of Service (QoS) aspects Relevant information: these slides (overview) course textbook (Part H) www.ietf.org (details) IP
Configuring Flexible NetFlow
Prerequisites for Flexible NetFlow, on page 1 Restrictions for Flexible NetFlow, on page 2 Information About Flexible Netflow, on page 4 How to Configure Flexible Netflow, on page 18 Monitoring Flexible
NAT Router Performance Evaluation
University of Aizu, Graduation Thesis. Mar, 22 17173 1 NAT Performance Evaluation HAYASHI yu-ichi 17173 Supervised by Atsushi Kara Abstract This thesis describes a quantitative analysis of NAT routers
Network Traffic Exploration Application. Presented By Grant Vandenberghe. (613)
Network Traffic Exploration Application Presented By Grant Vandenberghe Grant.Vandenberghe@drdc-rddc.gc.ca (613) 991-6464 Defence Research and! Development Canada Recherche et développement! pour la défense
EXAM TCP/IP NETWORKING Duration: 3 hours With Solutions
SCIPER: First name: Family name: EXAM TCP/IP NETWORKING Duration: 3 hours With Solutions Jean-Yves Le Boudec January 2013 INSTRUCTIONS 1. Write your solution into this document and return it to us (you
HP 830 Series PoE+ Unified Wired-WLAN Switch Switching Engine
HP 830 Series PoE+ Unified Wired-WLAN Switch Switching Engine Network Management and Monitoring Configuration Guide Part number: 5998-3936 Software version: 3308P26 Document version: 6W101-20130628 Legal
PacketExpert PDF Report Details
PacketExpert PDF Report Details July 2013 GL Communications Inc. 818 West Diamond Avenue - Third Floor Gaithersburg, MD 20878 Phone: 301-670-4784 Fax: 301-670-9187 Web page: http://www.gl.com/ E-mail:
Chapter 5 Network Layer
Chapter 5 Network Layer Network Layer IPv4 2 IP Header Application Header + data 3 IP IP IP IP 4 Focus on Transport Layer IP IP 5 Network Layer The Network layer (Layer 3) provides services to exchange
Cisco IOS Flexible NetFlow Command Reference
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
Contents. Introduction. Prerequisites. Background Information
Contents Introduction Prerequisites Background Information Limitation Configure Network Diagram Initial configuration R2 R3 IPSec configuration R2 EzPM configuration Workaround Verify Troubleshooting Related
Activating Intrusion Prevention Service
Activating Intrusion Prevention Service Intrusion Prevention Service Overview Configuring Intrusion Prevention Service Intrusion Prevention Service Overview Intrusion Prevention Service (IPS) delivers
Cisco dan Hotel Crowne Plaza Beograd, Srbija.
Cisco dan 31. 3. 2016. Hotel Crowne Plaza Beograd, Srbija www.ciscoday.com Three Friends in Security : Identity, Visibility and Enforcement Stop the bad guys immediately György Ács IT Security Consulting
Towards a collaborative, flow-based, distributed inter-domain Intrusion Detection System
Towards a collaborative, flow-based, distributed inter-domain Intrusion Detection System Frank Tietze Institut für Technische Informatik Fakultät für Informatik frank.tietze@unibw.de 1 Structure Introduction
Modular Policy Framework. Class Maps SECTION 4. Advanced Configuration
[ 59 ] Section 4: We have now covered the basic configuration and delved into AAA services on the ASA. In this section, we cover some of the more advanced features of the ASA that break it away from a
DNSSM: A Large Scale Passive DNS Security Monitoring Framework
samuel.marchal@uni.lu 16/04/12 DNSSM: A Large Scale Passive DNS Security Monitoring Framework Samuel Marchal, Jérôme François, Cynthia Wagner, Radu State, Alexandre Dulaunoy, Thomas Engel, Olivier Festor
CSC 4900 Computer Networks: Network Layer
CSC 4900 Computer Networks: Network Layer Professor Henry Carter Fall 2017 Chapter 4: Network Layer 4. 1 Introduction 4.2 What s inside a router 4.3 IP: Internet Protocol Datagram format 4.4 Generalized
How to Configure DNS Sinkholing in the Firewall
UDP DNS traffic handled by the Firewall service is monitored and, if a domain is found that is considered to be malicious, the A and AAAA DNS response is replaced by fake IP addresses. An access rule blocks
Multi Protocol Label Switching (an introduction) Karst Koymans. Thursday, March 12, 2015
.. MPLS Multi Protocol Label Switching (an introduction) Karst Koymans Informatics Institute University of Amsterdam (version 4.3, 2015/03/09 13:07:57) Thursday, March 12, 2015 Karst Koymans (UvA) MPLS
The Netwok 15 Layer IPv4 and IPv6 Part 3
1 ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE The Netwok 15 Layer IPv4 and IPv6 Part 3 Jean Yves Le Boudec 2015 Contents 1. Fragmentation 2. Interworking h4 h6 with NATs 3. Proxy ARP Textbook Chapter 5: The
FlowMonitor for WhatsUp Gold v16.3 User Guide
FlowMonitor for WhatsUp Gold v16.3 User Guide Contents Flow Monitor Overview Welcome to WhatsUp Gold Flow Monitor... 1 What is Flow Monitor?... 2 How does Flow Monitor work?... 2 Flow Monitor System requirements...
INSTRUCTIONS TO CANDIDATES
NATIONAL UNIVERSITY OF SINGAPORE SCHOOL OF COMPUTING FINAL EXAMINATION FOR Semester 2 AY2012/2013 Introduction to Computer Networks April 2013 Time Allowed 2 hours INSTRUCTIONS TO CANDIDATES 1. This exam
Cyber Threat Defence. Cisco Public BRKSEC Cisco and/or its affiliates. All rights reserved.
Cyber Threat Defence 2 Abstract Trends such as BYOD and the rise of the Advance Persistent Threat (APT) have led to the erosion of the security perimeter of the enterprise. The Cisco Cyber Threat Defence
Monitoring and Analysis
CHAPTER 3 Cisco Prime Network Analysis Module 5.1 has two types of dashboards: One type is the summary views found under the Monitor menu, and the other type is the over time views found under the Analyze
Chapter 4: outline. 4.5 routing algorithms link state distance vector hierarchical routing. 4.6 routing in the Internet RIP OSPF BGP
Chapter 4: outline 4.1 introduction 4.2 virtual circuit and datagram networks 4.3 what s inside a router 4.4 IP: Internet Protocol datagram format IPv4 addressing ICMP 4.5 routing algorithms link state
Detection of DNS Traffic Anomalies in Large Networks
Detection of Traffic Anomalies in Large Networks Milan Čermák, Pavel Čeleda, Jan Vykopal {cermak celeda vykopal}@ics.muni.cz 20th Eunice Open European Summer School and Conference 2014 1-5 September 2014,
Implementing Coarse, Long- Term Traffic Capture
Implementing Coarse, Long- Term Traffic Capture Michael Collins, CERT/Network Situational Awareness 2005 Carnegie Mellon University Outline of Talk Introduction To Work Logistics of Traffic Analysis Implementing
NetFlow Integrator Standard
NetFlow Integrator Standard User Guide Version 2.4.2 (Build 2.4.2.0.11) November 2015 Copyright 2012, 2013 NetFlow Logic Corporation. All rights reserved. Patents Pending. Contents About this Guide...
Mobile IP. Mobile IP 1
Mobile IP Mobile IP 1 Motivation for Mobile IP Routing based on IP destination address, network prefix (e.g. 129.13.42) determines physical subnet change of physical subnet implies change of IP address
Recent advances in IPv6 insecurities reloaded Marc van Hauser Heuse GOVCERT NL Marc Heuse
Recent advances in IPv6 insecurities reloaded Marc van Hauser Heuse GOVCERT NL 2011 2011 Marc Heuse Hello, my name is Basics Philosophy Vulnerabilities Vendor Responses & Failures Recommendations
Sampling Challenges. Tanja Zseby Competence Center Network Research Fraunhofer Institute FOKUS Berlin. COST TMA September 22, 2008
Sampling Challenges Tanja Zseby Competence Center Network Research Fraunhofer Institute FOKUS Berlin Desired Features for Traffic Observation Network-wide: multiple observation points Flexible: change
Internet Services & Protocols. Quality of Service Architecture
Department of Computer Science Institute for System Architecture, Chair for Computer Networks Internet Services & Protocols Quality of Service Architecture Dr.-Ing. Stephan Groß Room: INF 3099 E-Mail:
Stealthwatch System v6.9.0 Internal Alarm IDs
Stealthwatch System v6.9.0 Internal Alarm IDs Copyrights and Trademarks 2017 Cisco Systems, Inc. All rights reserved. NOTICE THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE
Configuring Flexible NetFlow
Prerequisites for Flexible NetFlow, on page 1 Restrictions for Flexible NetFlow, on page 2 Information About Flexible Netflow, on page 4 How to Configure Flexible Netflow, on page 16 Monitoring Flexible
Configuring NetFlow. NetFlow Overview
NetFlow Overview NetFlow identifies packet flows for ingress IP packets and provides statistics based on these packet flows. NetFlow does not require any change to either the packets themselves or to any
TCP /IP Fundamentals Mr. Cantu
TCP /IP Fundamentals Mr. Cantu OSI Model and TCP/IP Model Comparison TCP / IP Protocols (Application Layer) The TCP/IP subprotocols listed in this layer are services that support a number of network functions:
NetFlow Integrator Standard
NetFlow Integrator Standard User Guide Version 2.4.3 (Build 2.4.3.0.24) February 2016 Copyright 2012-2016 NetFlow Logic Corporation. All rights reserved. Patents Pending. Contents About this Guide... 3
Using NetFlow Sampling to Select the Network Traffic to Track
Using NetFlow Sampling to Select the Network Traffic to Track Last Updated: September 17, 2012 This module contains information about and instructions for selecting the network traffic to track through
Configuring IP SLAs TCP Connect Operations
This module describes how to configure an IP Service Level Agreements (SLAs) TCP Connect operation to measure the response time taken to perform a TCP Connect operation between a Cisco router and devices
Using Flexible NetFlow Top N Talkers to Analyze Network Traffic
Using Flexible NetFlow Top N Talkers to Analyze Network Traffic Last Updated: September 4, 2012 This document contains information about and instructions for using the Flexible NetFlow--Top N Talkers Support
OpenFlow DDoS Mitigation
OpenFlow DDoS Mitigation C. Dillon, M. Berkelaar February 9, 2014 University of Amsterdam Quanza Engineering Introduction Distributed Denial of Service attacks Types of attacks Application layer attacks
Configuring NetFlow. Information About NetFlow. Send document comments to CHAPTER
CHAPTER 11 Use this chapter to configure NetFlow to characterize IP traffic based on its source, traffic destination, timing, and application information, giving visibility into traffic transiting the
The Network 15 Layer IPv4 and IPv6 Part 3
1 ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE The Network 15 Layer IPv4 and IPv6 Part 3 Jean Yves Le Boudec 2017 Contents 9. Proxy ARP 10. Fragmentation 11. Interworking h4 h6 with NATs Textbook Chapter 5:
ECE 4450:427/527 - Computer Networks Spring 2017
ECE 4450:427/527 - Computer Networks Spring 2017 Dr. Nghi Tran Department of Electrical & Computer Engineering Lecture 6.2: IP Dr. Nghi Tran (ECE-University of Akron) ECE 4450:427/527 Computer Networks
CSE 4215/5431: Mobile Communications Winter Suprakash Datta
CSE 4215/5431: Mobile Communications Winter 2013 Suprakash Datta datta@cse.yorku.ca Office: CSEB 3043 Phone: 416-736-2100 ext 77875 Course page: http://www.cse.yorku.ca/course/4215 Some slides are adapted
EXAM TCP/IP NETWORKING Duration: 3 hours
SCIPER: First name: Family name: EXAM TCP/IP NETWORKING Duration: 3 hours Jean-Yves Le Boudec January 2013 INSTRUCTIONS 1. Write your solution into this document and return it to us (you do not need to
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track
Using NetFlow Filtering or Sampling to Select the Network Traffic to Track First Published: June 19, 2006 Last Updated: December 17, 2010 This module contains information about and instructions for selecting
From NetFlow to IPFIX the evolution of IP flow information export
From NetFlow to IPFIX the evolution of IP flow information export Brian Trammell - CERT/NetSA - Pittsburgh, PA, US Elisa Boschi - Hitachi Europe - Zurich, CH NANOG 41 - Albuquerque, NM, US - October 15,
Network Interconnection
Network Interconnection Covers different approaches for ensuring border or perimeter security Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Lecture
Cisco CCIE Security Written.
Cisco 400-251 CCIE Security Written http://killexams.com/pass4sure/exam-detail/400-251 QUESTION: 193 Which two of the following ICMP types and code should be allowed in a firewall to enable traceroute?