PDF p.329
In progress
Monitoring Infrastructure
Summary
PDF p.329Managerial reports are used for day-to-day monitoring of computer resources and network infrastructure. Network monitors and flow collectors help in tracking the status and performance of network appliances and traffic, providing insights into potential issues and attacks.
In plain words
Supplementary — not from your PDFNetwork monitors track the health of appliances (CPU, memory, state tables, disk, temperature, link errors) using heartbeats and SNMP traps with thresholds. Unusual conditions can indicate an attack. NetFlow (Cisco) and IPFIX (IETF standard) record flow metadata, grouped by the 5-tuple (source and destination address, protocol, source and destination port). This reveals traffic trends, anomalies, rogue behaviour, tunneling and command-and-control contacts, without capturing full packets.
Detailed explanation
PDF p.329Network Monitors
- Purpose: Collect data about network infrastructure appliances (e.g., switches, access points, routers, firewalls).
- Monitored Metrics: CPU/memory load, state tables, disk capacity, fan speeds/temperature, network link utilization/error statistics.
- Heartbeat Messages: Indicate availability.
-
Data Collection: Often uses Simple Network Management Protocol (SNMP).
- SNMP Traps: Inform management system of notable events (e.g., port failure, overheating, power failure, excessive CPU utilization).
- Thresholds: Set for triggering traps, providing alerts and alarms for hardware issues.
- Unusual Conditions: Network monitoring can reveal potential attacks.
NetFlow
- Purpose: Records metadata and statistics about network traffic.
- Sources: Switches, routers, firewalls, web proxies.
-
Features
- Trend and Pattern Highlighting: Traffic generated by applications, hosts, and ports.
- Anomaly Detection: Alerts based on flow analysis patterns or custom triggers.
- Visualization Tools: Map network connections and interpret traffic patterns.
- Rogue Behavior Identification: Detects malware, tunneling, bandwidth issues.
- C&C Channel Identification: Detects malware attempts to contact handlers.
-
NetFlow and IPFIX
- NetFlow: Cisco-developed reporting of network flow information.
- IPFIX: IETF standard for flow information export.
- Flow Labels and Records: Defined by packets sharing key characteristics (5-tuple: source address, destination address, protocol, source port, destination port).
- Flow Expiration: Exporter caches data and transmits to a collector when flows expire or become inactive.
Important terms
taken from the text above- Monitored Metrics
- CPU/memory load, state tables, disk capacity, fan speeds/temperature, network link utilization/error statistics.
- Heartbeat Messages
- Indicate availability.
- Data Collection
- Often uses Simple Network Management Protocol (SNMP).
- SNMP Traps
- Inform management system of notable events (e.g., port failure, overheating, power failure, excessive CPU utilization).
- Thresholds
- Set for triggering traps, providing alerts and alarms for hardware issues.
- Unusual Conditions
- Network monitoring can reveal potential attacks.
- Sources
- Switches, routers, firewalls, web proxies.
- Trend and Pattern Highlighting
- Traffic generated by applications, hosts, and ports.
- Anomaly Detection
- Alerts based on flow analysis patterns or custom triggers.
- Visualization Tools
- Map network connections and interpret traffic patterns.
- Rogue Behavior Identification
- Detects malware, tunneling, bandwidth issues.
- C&C Channel Identification
- Detects malware attempts to contact handlers.
- NetFlow
- Cisco-developed reporting of network flow information.
- IPFIX
- IETF standard for flow information export.
- Flow Labels and Records
- Defined by packets sharing key characteristics (5-tuple: source address, destination address, protocol, source port, destination port).
- Flow Expiration
- Exporter caches data and transmits to a collector when flows expire or become inactive.
SNMP Simple Network Management Protocol
Examples & real-world scenarios
Supplementary — not from your PDF- An SNMP trap when a firewall's CPU exceeds 90%.
- NetFlow showing a workstation sending gigabytes to an unfamiliar host.
- Flow visualization mapping who talks to whom.
Scenario
NetFlow shows a desktop making small, regular connections to the same external IP every 60 seconds. That beaconing pattern suggests malware contacting its controller.
Common mistakes
Supplementary — not from your PDF- Thinking NetFlow captures packet contents. It records metadata only.
- Leaving SNMP thresholds at defaults that never trigger.
Practical skills
Supplementary — not from your PDF- Name the fields in a flow 5-tuple.
- Spot beaconing in flow data.
What I should remember
Key Points PDF p.329-
Network Monitors
- Purpose: Monitor network appliances.
- Metrics: CPU/memory, state tables, disk capacity, fan speeds, network utilization.
- SNMP: Data collection and traps for notable events.
- Unusual Conditions: Potential attack indicators.
-
NetFlow
- Purpose: Record network traffic metadata.
- Sources: Switches, routers, firewalls, proxies.
- Features: Trend highlighting, anomaly detection, visualization, rogue behavior identification.
- NetFlow/IPFIX: Flow labels and records, flow expiration.