Network and Security administrators have several monitoring protocols available to help provide network insight and security awareness. Today, I’d like to talk about why flow technologies like NetFlow should be top of mind in this discussion.
Two years ago, I wrote a blog about tracking malware in encrypted traffic. The overall theme of that blog was that encryption has become much more of a standard. 2017 in particular was a milestone year in which the volume of encrypted traffic officially surpassed unencrypted web traffic. It’s safe to say that in three …
Inspecting encrypted traffic with JA3 and JA3S fingerprinting Read More »
One of the perks of working in technical support is learning something new every day. For instance, just earlier today I was on a call with a customer who wanted to make sure that Scrutinizer supports Viptela SD-WAN IPFIX exports. My colleague James Lawrence had previously touched upon Viptela IPFIX support, so I thought that …
If this ever changin’ world in which we live in makes you give in and cry say I’m only one guy
Whether you work primarily on the networking side of the house or the security side, you’ll need to ingest metadata into at least one of the tools in your toolbox. In my experience, it’s often the same data sets are often being generated multiple times from the same raw packet. This can put an extreme …
Over the years, libraries have been filled on the topic of flow protocols—specifically, how they work and their general accuracy.
I spend a large amount of time day-to-day working with customers to understand how they can best leverage their current NetFlow/IPFIX data to solve a variety of problems. What I’ve begun to realize is that there are many different use cases for leveraging metadata, and the format in which data can be most useful will …
Recently I’ve had many requests from customers who upgraded to the Catalyst 9500 series and are looking for a NetFlow configuration document. So I’ve put together this guide for configuring FNF (Flexible NetFlow).
Let’s talk about the cloud for a minute. A majority of IT infrastructure has been moving to the cloud over the last few years, and for good reason. The cost-saving benefit, ease of administration and space reduction are all good reasons to move your internal applications to the cloud. This movement of offloading hardware to …
We’ve seen a lot of coverage regarding the growth of Extreme Networks lately. Between their recent acquisition of Brocade and Avaya, it would appear that they are serious about expanding their product lineup to increase performance and network visibility; by means of the type of NetFlow exported by their devices.