Author: Jeff Morrison

Jeff Morrison is a Solutions Engineer here at Plixer. He is responsible for travelling on-site to provide assistance with initial deployment, setup and design, in-depth training, and custom configurations. While in the office Jeff is responsible for providing technical assistance on initial overviews, providing training for internal resources, and researching integrations with 3rd-party vendors. When not on the road travelling, he enjoys playing music, riding motorcycles, video games, and spending time with friends and family.

Network Operations

Wildcard Mask Filters Within Scrutinizer

03.07.18 - Jeff Morrison

While working with users, I’ve noticed scenarios where filtering traffic based on a CIDR or an IP range just isn’t enough control. I wanted to explore another option—wildcard netmask filters! Let’s walk through how they work, and how they can be applied.

Network Operations

Creating a Network Map

12.27.17 - Jeff Morrison

Network Maps provide end-users with a high-level view of what their network topology looks like, as well as how traffic is flowing through your network. Most commonly, I see them used as a quick reference to determine if there’s any link saturation happening. What if we were to combine mapping functionality with some of the unique elements exported in flow data today? Read more

Network Operations

Tracking Malware Hidden in Encrypted Traffic

10.25.17 - Jeff Morrison

I feel comfortable saying that all of us know what encrypted data is. Web encryption, specifically, has been around for quite some time now. Secure Socket Layer (SSL) did take a long time to be considered widely adopted, however—twenty-two years, to be exact! 2017 marks a milestone because there is now officially more encrypted web traffic than not.

This is great news; the more encrypted data the better off we are, right? But while that certainly is true, we’ve also seen an enormous rise in attacks leveraging SSL/TLS to mask their activities. Hackers commonly use it to hide communications between compromised hosts and the command and control server that issues instructions, payloads, or other bits of information. Fortunately, this hasn’t gone unnoticed, and vendors are tackling ways to overcome the issue. In this blog I’d like to take a glimpse into the future and talk about leveraging Cisco’s Encrypted Traffic Analytics (ETA).

Security Operations

Network Behavior Analysis and User Behavior

08.23.17 - Jeff Morrison

As flow data becomes a growing asset for security analysts, a question arises: “Can I get more context and how do I best leverage this data?” In the security realm, flows are best used to monitor user behavior and network traffic patterns, providing us an additional layer of security to our existing signature-based detection and prevention systems. Today, I will go over an algorithmic approach to network security.

Configuration

Gigamon IPFIX Configuration

06.07.17 - Jeff Morrison

Today I want to take a look at the Gigamon appliance and their IPFIX configuration. Recently I was asked an interesting question: an avid user of Scrutinizer had a very specific element he wanted to collect and monitor. He wanted to trend what SSL version his internal servers are currently running, as well as the most common version his users come across in the wild. Now, immediately my mind jumped to decryption or deep packet inspection. I knew that with a bit of work we could accomplish this using our FlowPro, which already does DPI. But wait, is there a simpler way?