Network Analysis Tools Flashcards
(60 cards)
purpose is to track usage, identify unusual traffic, and view the traffic in detail;
analyzes network traffic to understand a normal network baseline
decode streams of bits flowing across a network & shows them in a structured format
Protocol analysis / protocol analyzers
Analyzes streams of protocol data and displays bits in a structured format
protocol analyzer
**5 distinct functions of a protocol analyzer/protocol analysis;
5 STEPS
1) Data capture - locally (requires an interface & NIC) or remotely(remote analyzers, capture agents, remote control)
2) Network Monitoring
3) Data display
4) Notification Logging
5) Packet Generation
a mechanism that collects information about a network;
network info that gets monitored and comes from various sensors;
where you’re collecting from, such as a NIC card or ethernet
sensor
network traffic must pass thru this sensor, enabling it to have the ability to stop attacks by blocking network traffic
in-line sensors
monitors a copy of the actual traffic;
deployed to monitor the DMZ
passive sensors
a device that monitors and collects data about network activity, which can then be used for analysis and decision-making;
Sensors should be placed at the right place within the network
sensor
After your network is installed, you should turn on _________, so that your NIC can also learn about packets that are not destined/routed to your machine;
___________ operate in promiscuous mode, which means they are able to view all traffic on the local media. This characteristic allows them to provide a wide range of statistics about what is happening at each layer of the OSI model
promiscuous mode;
analyzers
what is used to capture data outside of your network?
analyzers
capture traffic on segments that you cannot physically access
remote analyzer
software drivers running on a computer that allow you to capture packets to and from the LAN interfaces
capture agent
analyzers running on a machine being controlled by software that allow you to remote into a computer
Remote Control
**what the normal performance standards are for a network so you know what it is capable of;
help you determine when something on the network is abnormal & if it can handle policies;
should be captured at normal peak running hours
network baseline
What mode do analyzers operate in to view all traffic on the local media?
Promiscuous mode
two methods of capturing data
locally and remotely
**Approach that focuses on the needs and goals of the org;
starts at the top, and works its way in design down;
1. analyze requirements
2. design topology from a logical standpoint
3. Physical design from a physical standpoint
4. test designs, run baselines, and determine improvements
top-to-bottom monitoring (starts with the Application layer flowing down to the Physical Layer 1)
building a network and determining if the network infrastructure is there;
making sure you have enough servers, computers, etc.
top-to-bottom networking
gathering log data to track resource use, bugs, availability, load balancing issues, monitoring, and more;
provide alerts to live anomaly events;
Through _________, it provides a way of seeing which events form a casual chain that led to alerts across multiple services;
helps network run smoothly
app monitoring;
distributed tracing
All of the following are parts of Application monitoring:
1) ______: evaluates the users experience; are tasks running as expected?
2) ______: traffic rates; how much info is being requested/sent?
3) ______: storage issues, excessive loads, hardware issues, etc
4) ______: is one resource being used too much that can lead to bottleneck issues?
5) ______: memory & storage capabilities
6) ______: is data being stored properly so that it is accessible?
7) ______: distributing data evenly across resources
*1) User experience
*2) App Traffic
*3) Physical & Virtual servers
4) App dependencies
5) Storage & resource capacity
6) Caching Layer Metrics
7) Load Balancing metrics
the process of analyzing a packet;
it is done to gain insight on the devices and users sending data across a network;
3 tools used are Wireshark, OS Fingerprinting, & tcpdump(BPF filters);
1) plan 2) deploy 3) capture 4) analyze 5) refine
how is packet analysis conducted?
packet analysis;
packet capture (packet capture programs ‘capture’ the packets that go across a network)
Wireshark is the most popular packet analysis tool that allows you to monitor your network in real time, at a small level. it’s 3 useful functions are:
1) Protocol Hierarchy
2) Conversations
3) Endpoints
organizes protocols into layers based on the rules of communication
protocol hierarchy
**two people involved in the conversation;
how many packets did i send to you, how many packets did i receive from you;
who was the most talkative?
conversation
**machine with a MAC address that is the source of something
endpoint
