Instructor: As you might have guessed, 2 2
packet captures can take up a lot of storage space 3 3
and they can grow quickly in size. 4 4
For example, if I'm conducting full packet capture 5 5
on my home network each day, 6 6
I would need several gigabytes of storage 7 7
just for my small family 8 8
because every single packet that goes in and out of my house 9 9
would be captured. 10 10
Every video game my son is playing online, 11 11
every YouTube video he watches, 12 12
every Netflix show my wife binges, 13 13
all of that would be captured bit by bit. 14 14
This is known as a full packet capture. 15 15
Now, a full packet capture or FPC 16 16
is going to capture the entire packet. 17 17
This includes the header and the payload 18 18
for all traffic that is entering or leaving your network. 19 19
As I said, this would be a ton of information 20 20
and quickly eat up all of our storage. 21 21
Now, because full packet capture 22 22
takes up so much storage space, 23 23
a lot of times we won't collect it. 24 24
Instead, we'll use something called flow analysis, 25 25
and this relies on a flow collector. 26 26
Now, a flow collector is a means of recording 27 27
metadata and statistics about network traffic 28 28
rather than recording each and every frame 29 29
that's going over our network. 30 30
This allows us to use flow analysis tools 31 31
that provide network traffic statistics 32 32
sampled by the collector. 33 33
This way we can capture information about the flow 34 34
instead of the data itself, saving us a lot of space. 35 35
But we aren't going to have the contents 36 36
of what was going over the network, 37 37
just information about it. 38 38
Now, this information can be stored inside of a database 39 39
and queried later by our different tools 40 40
and produce reports and graphs. 41 41
This is the idea of flow analysis. 42 42
Now, the great thing about flow analysis 43 43
is it's going to allow us to highlight trends and patterns 44 44
in the traffic being generated. 45 45
It allows us to get alerts based on anomalies 46 46
that we might see and different patterns and triggers 47 47
that we might see. 48 48
We can also have visualization tools 49 49
that allow us to quickly create a map 50 50
of different network connections and the flow patterns, 51 51
and we can identify different traffic patterns 52 52
that might reveal bad behavior, malware in transit, 53 53
tunneling, and other bad things out there. 54 54
Now, to do this, we can use several different tools. 55 55
For instance, there is NetFlow, Zeek, 56 56
and Multi Router Traffic Grapher. 57 57
Let's talk about each of these. 58 58
First, we have NetFlow. 59 59
NetFlow is a Cisco-developed means 60 60
of reporting network flow information 61 61
to a structured database. 62 62
This is one of the first ones out there, 63 63
and eventually it actually became the standard 64 64
that everyone started using 65 65
under the name IPFIX or IP Flow Information Export. 66 66
Now, this allows us to define a particular traffic flow 67 67
based on the different packets 68 68
that share the same characteristics. 69 69
For instance, maybe it's the same source and destination IP 70 70
signifying that there's a session between two hosts. 71 71
That would be one data flow, 72 72
and we can get information about it. 73 73
Now, some of the information we can capture 74 74
inside of NetFlow is going to be information about the packets 75 75
that go over the devices, 76 76
things like the network protocol interface 77 77
that's being used, the version and type of IP being used, 78 78
the source and destination IP address, 79 79
the source and destination port, 80 80
or the IP's type of service. 81 81
All of this information can be gathered 82 82
and then we can actually analyze it and look at it visually 83 83
using different tools. 84 84
For example, here on the screen, you can see that I'm using 85 85
the SolarWinds tool to show the NetFlow data of a network, 86 86
or you can look at it in a text-based manner. 87 87
For instance, here you can see the different flows 88 88
that are there going from one all the way down to flow 15, 89 89
and as I increase the ability to look into flow 15, 90 90
you can see the source and destination address, 91 91
the source port, the destination port, 92 92
and some basic information about it, 93 93
but you don't see the content of any of those packets 94 94
that have been going through. 95 95
Now because of this, 96 96
NetFlow is going to provide you with metadata 97 97
but you're not going to have the full packet captures, 98 98
so you're not going to have a complete record 99 99
of what's happening. 100 100
Now, if you want to be able to have the best of both worlds, 101 101
you can use something like Zeek. 102 102
Zeke is a hybrid tool that passively monitors your network 103 103
like a sniffer, 104 104
but it's only going to log full packet capture 105 105
based on data of potential interest. 106 106
So essentially it's going to be sampling that data 107 107
just like NetFlow does, 108 108
but when it finds something that's quite interesting, 109 109
it's going to log the entire thing, 110 110
so we can then go back and look at that. 111 111
This helps reduce our storage 112 112
and our processing requirements, 113 113
and it gives us an ability to have all this data 114 114
into one single format. 115 115
One of the great things about Zeek is that it performs 116 116
normalization of the data 117 117
and then it stores that data as a tab-delimited 118 118
or JavaScript Object Notation language, 119 119
JSON-formatted text files. 120 120
This allows you to use it 121 121
with lots of other different tools. 122 122
For instance, here you can see on the screen 123 123
that since this file was normalized, 124 124
I could import it into another tool for visualization, 125 125
searching, and analysis. 126 126
In this image, I've imported the Zeek log into Splunk 127 127
and from there I'm able to search for specific information 128 128
during my analysis of a potential incident. 129 129
The third tool we have 130 130
is the Multi Router Traffic Grapher or MRTG. 131 131
Now, if you took Network Plus, 132 132
you've been introduced to this before 133 133
because it was on that syllabus as well. 134 134
The MRTG is a tool that's used to create graphs 135 135
that show network traffic flows 136 136
through the network interfaces 137 137
of different routers and switches 138 138
by polling those appliances using SNMP, 139 139
the Simple Network Management Protocol. 140 140
This looks like this graph here on the screen. 141 141
Now, what is useful about this? 142 142
Well, you can see patterns emerging. 143 143
For instance, in the top graph on the router firewall, 144 144
where do you see a big spike in traffic? 145 145
You can see that there's a big spike in traffic 146 146
between 2:00 and 4:00 am. 147 147
Now, is that normal? 148 148
Maybe and maybe not, but it's something we should go 149 149
and further analyze, because if we see a big spike 150 150
between 2:00 and 4:00 am, that could be something normal, 151 151
like we are doing offsite backups, 152 152
and therefore we're going to do that during off-peak hours, 153 153
and you'll see a big spike in traffic 154 154
as we're sending our data to our offsite facility. 155 155
Maybe that's a reasonable explanation, 156 156
or maybe the server has been infected with malware 157 157
and at 2:00 to 4:00 am when we're all home sleeping, 158 158
they're sending all the data back to the bad guy 159 159
who's now collecting our data as part of data exfiltration. 160 160
We don't know just by looking at this 161 161
which of those two cases it is, 162 162
but by looking at this we can identify 163 163
that we should zero in between 2:00 and 4:00 am 164 164
and figure out what was that additional traffic flow 165 165
that happened and why. 166 166
So based on this, we might make a hypothesis 167 167
that we think data exfiltration is happening. 168 168
In that case, we would want to set up a network sniffer 169 169
in front of this server to see what traffic is leaving 170 170
and where it's going to. 171 171
Based on that, we can then dive deeper 172 172
to see if it was something that was known good, 173 173
such as a backup, or known bad, such as a bad guy.