Attacks/Breaches
4/10/2009
01:39 PM
Connect Directly
RSS
E-Mail
50%
50%

Tech Insight: Making The Most Of Open-Source Forensics Tools

Emerging offerings can turn network forensics into a low-cost, do-it-yourself security project

A Special Analysis for Dark Reading

Network forensic solutions come in many different shapes, sizes, and price ranges, but in the end they all have the same goal: recording activity on the network. As IT budgets tighten with the economy, it might be time for your organization to take a closer look at a do-it-yourself approach to forensics that leverages free and open-source tools.

While your CFO might love the price of these tools, it may be difficult to "sell" them to your IT management. Most IT executives want someone to point a finger at when a product breaks, and many want 24x7 support. While some of the free and open-source tools do have ties with a company that can be paid for support, most do not.

But don't let the support question turn you away. Today's open-source network forensic tools are incredibly capable, and they can run on old hardware sitting around your shop. Your cost: little to nothing. In the current economy, that's a pretty compelling business case.

Making the case to build your own network forensics capabilities often means highlighting the shortcomings of your company's existing tools. For example, you should explain to management that while your intrusion-detection system (IDS) implementation is great, it lacks context to know whether an attack was successful. A network forensic tool recording all traffic can show what happened at the network level -- during and after an attack.

Network forensic tools also fill in the blanks when performing internal investigations. System logs show that a user logged in, but little else. With all traffic captured to disk, network forensics can often show what was accessed and when. Files can even be extracted from the captured traffic.

Building a basic network forensic system -- including installing the software and deploying it -- can be accomplished quickly. But teams looking to take the initiative and get the most out of it should do their homework first. Basic questions to help define the project include:

  • Do you need to capture all network traffic, or is network flow data enough?
  • Is capturing traffic at the network gateway enough, or should it be recorded at multiple points in the network?
  • How far back should the recording go?

The decision to capture all traffic or only network flow data depends on the purpose of the collected data, network layout, and bandwidth. Collecting network flow data is equivalent to a phone bill, which shows which number called another number, at what time, and for how long.

When you collect only network flow data, no actual content is captured, which has pros and cons. The pros are that storing flow data doesn't take up much space, and you can use the existing network hardware's ability to export flow data. On the other hand, because you're not collecting content, you may not have all of the information you need to determine what really happened.

Your placement of capture devices will depend on your organization's motivation for implementing the forensics tools. If your primary goal is just to fill in the gaps of IDS, placing devices just behind the Internet gateway will probably suffice. However, if you want to address concerns like insider threats, capture points should also be set up at network choke points to capture user activity between the Internet and the data center.

Determining how far back to keep captured data is an internal decision that again depends on your goals for the network forensics solution. For supplementing an IDS, a couple of months should suffice. Six to 12 months might be more appropriate for internal investigations and insider threat concerns. Think about why you want to do the monitoring, how much bandwidth is on your network, and what your available hardware can handle. After considering those factors, you may decide to capture more data -- or less.

With free and open-source tools, network forensics can be done on the cheap. Often, you can do it with no more than an inexpensive 1U server or existing hardware, a large hard drive, and a network tap or monitoring port on a switch. A plethora of low-cost software can be had that can capture all traffic or just network flow data.

Daemonlogger, tcpdump, and tshark are three examples of free, open-source tools that do a great job of capturing network traffic to the disk. Each one supports ring-buffering, so you can define how much data they should store on disk (by percentage), how to split the different capture files (by time or size), and how to automatically overwrite the oldest files.

Once you have the network data captured to disk, you can use other low-cost tools for analysis, such as Wireshark, NetWitness Investigator, or NetworkMiner. And even if you use an off-the-shelf IDS, you can still use the open-source Snort as a "second opinion" on the captured traffic.

Doing network forensics yourself is an alternative, no matter what your organization's size or financial situation. Free tools have been developed to record the data to disk and to analyze the contents. In this economy, it's certainly an option worth considering.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.