-: Network Monitoring Tools.
In the last lesson we talked about
some active and passive monitoring techniques.
Let's talk specifically about the tools in this lecture.
There's many different network monitoring tools out there,
and we're going to talk about a couple of them
so you can figure out what works best for your use-case.
There's a combination of network data that becomes
more powerful than any single piece of data,
and that's where the corelation comes in.
So these tools will allow us
to get information from various different sources,
and instead of just having individual log files,
it will correlate them, and mesh them all together,
so we can get a better idea as an analyst.
These different tools can analyze the data
in different ways as well,
and display them graphically in different ways,
that's going to help our understanding.
One of the first ones I want to talk about is Wireshark.
I talked about passive collect in the last lesson,
and we talked about passive monitoring, and packet capture.
Now Wireshark allows you to do packet capture,
and more importantly, it allows you
to do packet analysis on that data being captured.
You can see every single piece of data
that goes in and out of your network,
and look at the contents of those packets
to determine what was sent and where it went to.
This is where Wireshark really shines.
It allows you to go through using the filtering,
and really dive in to an individual packet,
or sequence of packets,
and figure out what is going on in your networks.
The next one I want to talk about is SolarWinds.
SolarWinds is a netflow traffic analyzer.
It takes all that information of netflow,
and graphically displays it,
to try to make things a little easier for you to understand.
It also does a really good job of telling you
where are your top endpoints, by usage and bandwidth,
and other things of that nature.
Now if you want to play with SolarWinds,
I recommend going to demo.solarwinds.com.
There's an online version,
you can try it out for free,
and just get used to using this tool,
just a little bit, because it'll help you on the exam
to understand what the tool is, and what it does.
Now the next one that you get is also from SolarWinds,
and this is, again, you can play with it at
demo.solarwinds.com, and it's a network performance monitor.
It's going to tell you what's up, what's down,
and it's generally used as part of
the IT service management suite,
but there are information in here
that we can get as an analyst that's helpful to us.
As you can see here, we can see
all of the nodes on our network,
wherever they are in the world,
and we can see what's up, what's down,
and what has a lot of errors.
Now, why is that important to us?
Well, if something's having a lot of errors,
there may be something wrong with it,
either with the switch, or the router,
or there could be some malicious software going on.
All those things would be something
that we'd want to look at through our ITSM processes,
to look at through problem management and incident response.
PRTG.
It stands for the Paessler Router Traffic Grapher.
This is an open source program that is free to use.
It is a server monitoring, network monitoring,
and bandwidth monitoring program.
Very similar to a lot of the stuff
you can get out of SolarWinds,
but here is a free version
that will graphically display it as well,
where SolarWinds is a commercial product.
Now when you look at PRTG,
it does provide you with many different functions.
It has packet sniffing, so it can monitor
the packet headers to determine the different traffic types.
It has different flows.
It'll collect information about the connections.
It has SNMP, and it gets all the devices
reporting into it on their status
of ups and downs based on their trap status.
And it has WMI feeds,
which is Windows Management Instrumentation.
It'll give you data from
your Windows servers on the network,
and feeds into it as well.
PRTG is a great piece of software,
and I recommend checking it out,
and seeing if it works for your use.
The next one we have is Nagios,
and Nagios is a network and system log monitoring tool.
It's going to provide you with a graphical user interface
for system services and monitoring capabilities.
You can see here on the screen
that it's based on geography, or area of your networks.
In this case Argentina, Uruguay, and Atlanta, Georgia,
and it tells you is everything up, is it down,
is there errors, or is there issues.
Then we can use that and go into it further,
to dive down deep.
Now, in the dashboard you can see sometimes
there's things called "criticals",
and this is an example.
When I dived into that critical area,
you could see that there is a lot of red on this screen,
and we'd start looking at that
from an analysis poerspective.
Now critical in Nagios isn't based
on CVE descriptions of critical,
like we had from the NIST publications,
but instead it's based on thresholds
that you set during your configuration.
So what's critical for your organization,
may not be critical for mine, and vice versa.
Just something to keep in mind as you use Nagios software.
The next one we're going to talk about is Cacti,
and Cacti uses SNMP polling
of your network devices for status information,
and shows them in a graphical environment.
Again, this is another tool that can be used
both on the ITSM, or service management side,
as well as on the cyber analyst side.
You can see here where we can see traffic patterns,
we can see where there's spikes, and where there's not,
and then we can start analyzing that
to see is it malicious or not.