During the years 2006 and 2007, reporting on NetFlow collection was a very good market for software developers.
These software developers provided tools that allowed companies to rid the network of unwanted network traffic.
They aided in the isolation of computer viruses and helped stop employee abuse of the internet, however, there are more problems to find using NetFlow.
 Network Behavior Analysis (aka NBA) has been brewing in the NetFlow world for over a year. Vendors such as venture funded Lancope have helped pioneer the concept.
"StealthWatch uses behavioral learning, statistics and mathematical equations to pick up on patterns of malicious activity in NetFlow messages," said Adam Powers – CTO of Lancope. |
Early consumers have paid dearly to get in early on the technology and ROI can be difficult to solidify on a $100K investment.
 Like the first digital watch, prices will start to drop as vendors such as Plixer International enter the market.
"We are in the early stages of beta testing our NBA module for Scrutinizer," said Michael Patterson – Chief Executive Officer of Plixer International. "Security algorithms that deduplicate and sniff for behavior anomalies will be in the release." |
NBA is a technology where the NetFlow collector looks for unhealthy patterns in network traffic.
Hosts scanning the network with SYN floods or end systems receiving excessive RST/ACK packets send up a red flag and ultimately cause an alarm.
These behavior patterns exist in an area where the IDS may not recognize the problem and traditional thresholds set for byte or packet volumes won’t be effective.
End system behavior problems can come in the format of low volume traffic.
For example, a host receiving 100 host unreachable packets from the router is likely to go undetected without a NBA system in place.
Are YOU reporting on NetFlow and will YOU be ready for Network Behavioral Analysis?
| Reggie Grant Profile |
About Brad Reese on Cisco
Brad Reese is research manager at BradReese.Com, advancing the careers of 1 million certified individuals in the growing Cisco Career Certification Program.
Contact him.
Brad's blogroll
Brad Reese on Cisco archive.
Cisco Subnet
|
|
Security tester's take: NetFlow for endpoint security
Rodney Thayer, independent network security consultant, sees an interesting future for NetFlow.
Here's what he says:
"... seems to me that if we actually use this flow technology we could do a whole bunch of good things in network management and security. For example, it watches the network flows so you can see things such as peer-to-peer traffic, Skype and who's using your network a lot that you didn't think was. Used properly ... it would be useful for some of the kinds of things we're doing now with looking for botnets and worms, and for endpoint security, 'monitor your network' kinds of stuff."
Read more