NetFlow Data: Is there such a thing as too much?

Posted in NetFlow, NetFlow Analyzer, Network Traffic Analysis on March 26th, 2010 by nathanh
netflow-data-is-there-such-a-thing-as-too-much

I love Chinese food. I eat at our local Chinese restaurant probably once every two weeks. As I scan the menu, I always crack up at the kids section of the menu. For here I am, contemplating which Lo Mein deliciousness I want and then my eye catches the word ‘cheeseburger‘.

I always kind of chuckle at that: “Who really orders a cheeseburger at a Chinese joint?!”

But when I think about it, they must have had a reason to post burgers, mac and cheese and hot dogs on the menu…

See, when you get that craving for a Pu Pu platter and a Scorpion bowl, there’s probably a good chance that your kids won’t appreciate your selection. So to appease the children, let’s get them something they will end up eating.

Here’s my point.

Read more »

Tags: , , , , , ,

Scrutinizer v7.3 – Flow Analytics – Breach Attempt Violation

Posted in NetFlow, Scrutinizer on December 7th, 2009 by scottr
scrutinizer-v7-3-flow-analytics-breach-attempt-violation

Well it looks like our run of nice weather has ended here in Southern Maine. Saturday we had our first snow of the year. It was kind of a nice touch to be at a holiday party and have the snow falling outside. And then to wake up Sunday morning to find that the view outside your window is like that of a Currier and Ives winter print.

A couple of weeks ago I began a series of blogs that introduces you to the new Flow Analytic tools that are available with Plixer International’s latest NetFlow and sFlow analysis tool, Scrutinizer v7.3.

Today I will be introducing you to the third of the four new analytic tools now available with Scrutinizer v7.3. The Breach Attempt Violation looks for many small flows from one source to one destination. This can indicate things such as a “brute force” or “dictionary” attack. 

Read more »

Tags: , , , , , , , , , , , , , , ,

We had a port scan running rampant. Do you?

Posted in General, Network Problem Resolution, Scrutinizer on June 12th, 2009 by nathanh
we-had-a-port-scan-running-rampant-do-you

Here at Plixer, we love giving demonstrations of our product and Go To Meeting is a beautiful tool to show our potential customers the functionality and features of Scrutinizer.

Of course, when giving these demos, sometimes we find things on our own network that we didn’t really anticipate. It was during one such demonstration that my boss found traffic that suggested my laptop was infected with a worm. Let me tell you, that was kinda embarrassing…

So the other day, I’m sitting at my desk and listening to Mike during his presentation when I hear the words, “This looks legitimate…” and “Mitch, your laptop is scanning the network.”

Here we go again…

The funny thing was that our DNS server was running with some old lookup records, so Scrutinizer resolved the IP in question as MixMasterMitch when in reality, it was Mike’s own laptop.

You heard that right. Mike’s laptop was the one that was doing the port scans. At least I’m not alone anymore…

mikeworm2
-Nate

Tags: , ,