Author: Jeff Morrison

Jeff Morrison is a Solutions Engineer here at Plixer. He is responsible for travelling on-site to provide assistance with initial deployment, setup and design, in-depth training, and custom configurations. While in the office Jeff is responsible for providing technical assistance on initial overviews, providing training for internal resources, and researching integrations with 3rd-party vendors. When not on the road travelling, he enjoys playing music, riding motorcycles, video games, and spending time with friends and family.

Configuration

Cisco ASR 9000 Configuration NetFlow Guide

02.02.16 - Jeff Morrison

One of the best parts about working in Tech Support for a company that analyzes NetFlow, is that I get the opportunity to work with a wide variety of vendors and models. Today most vendors are supporting at least one form of NetFlow. Whether that’s version 5, version 9 or IPFIX. No matter what version of NetFlow, we’re awarded the ability to capture and analyze the traffic on our network in almost real-time. Today I wanted to take a look at the founders of the NetFlow protocol, Cisco, and their Cisco ASR 9000 configuration.
Read more

General

Network Forensic Analysis

11.20.15 - Jeff Morrison

When an incident or threat occurs on our networks today one of the more plaguing questions that comes up is “How can I leverage the tools I have to gain more contextual details and find the root cause”? This is a difficult question to answer. All vendors and devices have their areas in which they excel. Today I’d like to focus on utilizing a Dell SonicWALL to leverage better Forensic Analysis for an occurrence.

Configuration

Juniper MX NetFlow Configuration

09.16.15 - Jeff Morrison

Juniper MX5 NetFlow Configuration

Recently while looking at my router’s NetFlow reporting, I came across an issue regarding the Juniper MX5 router’s NetFlow configuration. I had a customer recently with two Juniper MX5 routers; both running the same configuration, but one had newer firmware, Junos version 14.2R2.8. We found was both devices were actively exporting flows to the analyzer, but only one device was able to pull reports. When we tried running a report in our IPFIX and NetFlow Analyzer we were prompted with the ‘Select Template’ message, even though we had already received option templates and they were readily available. Juniper’s site offers additional details about configuring for your Juniper router. Read more

General

NetFlow Security Monitoring

05.15.15 - Jeff Morrison

NetFlow Security Monitoring

When you hear NetFlow/IPFIX, what is your first thought? For most people, their first thought will be “NetFlow’s great for performance monitoring” or “IPFIX allows us to monitor a user’s traffic, even Layer 7 traffic”. These are the most common applications of flow technologies, but what about NetFlow security monitoring or incident response? If flow data can give me the Who, What, When and Where, then why not leverage these contextual details in your forensic investigation. Most people will tell you they’re happy using their IDS or IPS, alerting when a signature-based attack is detected. The problem here is two-fold.