www.lonerunners.net
lab.lonerunners.net
Sniffing: SPAN port vs TAP
Sometimes the only way to do network monitoring and sniffing is using SPAN ports on network devices.I think that SPAN its not all bad but you must know that its limitations to be compliance with your requirements. This article can explain a lot of things that for a lot of network administrators is a unexplored [...]
Documentation about Netflow
Here is some documentation about NetFlow, slides, papers, and how to:
The Ultimate Netflow Data Realtime Analysis
nProbe: an Open Source NetFlow Probe for Gigabit Networks
NetFlow Version 9
NetFlow: Information loss or win?
Netflow Tools NfSen and NFDUMP
Cisco NetFlow and NBAR
NetFlow @ DANTE
Traffic Monitoring with Netflow
Cisco CNS NetFlow Collection Engine Version
Scrutinizer & Firewalls
Bitmap Algorithms for Counting Active Flows on [...]
Papers about NetFlow applications
Properties
and Prediction of Flow Statistics from Sampled Packet Streams
Nick Duffield, Carsten Lund, Mikkel Thorup, Proc. ACM SIGCOMM
IMC, 2002. A detailed investigation of the effects of packet sampling
on flow-based traffic accounting.
TCP Use and Performance on Internet2
Stanislav Shalunov, Benjamin Teitelbaum, ACL SIGCOMM IMW, 2001.
See the pointer to the
Abilene usage report page in [...]
Monitoraggio di rete con NetFlow all’ESC07
Questo week end saro` presente all’End Summer Camp, l’evento informatico di chiusura estate, dove sabato 15 settembre terro` il mio talk intitolato "Monitoraggio di rete con NetFlow" che raccontera` la storiella di come monitorare reti di elaboratori medio/grandi utilizzando il protocollo NetFlow, da cosa e` a che strumenti utilizzare.
Netflow software list
Some lists of NetFlow related software.Links:
Free NetFlow Tools
Freshmeat NetFlow
Introduction to NetFlow-based Security Monitoring
Beautiful slides from Lancope about NetFlow, a good introduction for newbie: Introduction to NetFlow-based Security Monitoring
Rilevare gli attacchi DoS con NetFlow
L’utilizzo di NetFlow permette di fare monitoraggio e accounting con il minimo impiego di risorse per gli apparati.In caso di attacco DoS in numero di flussi esportati dalle apparecchiature di rete aumenta vertiginosamente, quindi risulta un semplice strumento per rilevarli. (Semplice ma per nulla user-friendly)Anche se continuo a credere che il modo migliore per segnalare [...]
Stager
Alla fine dopo vari prodotti e test ho scelto Stager come strumento per la visualizzazione di dati provenienti da NetFlow.
"Stager is a system for aggregating and presenting network statistics.
Stager is generic and can be customized to present and process any kind
of network statistics. The backend collects data and stores reports in
a database, automatically handling the [...]