LoveMyTool - Open Community for Network Management and Monitoring

Real Visualization for Network Professionals (by The Oldcommguy)

TAP or SPAN (RSPAN)

By: Tim O’Neill – The Oldcommguy™

Author’s comments:

• All Rights are reserved – Copyright 2013 by The Oldcommguy™!
• No one may repost this article without receiving permission!
• If permission is given then it must be posted as it is, in full context, WITHOUT any changes!

This is an updated version of my original article that was written in 2007 –

http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html

A Super Video Class from Sharkfest by a world class Trainer and Analyst – Betty DuBois –

http://blip.tv/lovemytool/span-port-vs-tap-by-betty-dubois-2290452

and part of the Ixia Team Blog –

http://blogs.ixiacom.com/ixia-blog/to-span-or-to-tap-that-is-the-question/ 

 The goal of Network, Security, Compliance, and Application managers requires FULL visualization of the Network and the packets therein!

Real Visualization is EVERYTHING!

If you cannot see an issue, like an attack, misusage, inefficiency, etc., then how are you going to understand it and resolve it? Here are the REAL facts about needing REAL TAPs!

Batteries in my TAP, in my Network, What are you thinking? (by The Oldcommguy)

There is a new trend of putting batteries in network access devices that I am really not sure of, so here are my thoughts as well as some very sobering and REAL documented issues!

 First let’s talk about the reality of batteries, ALL BATTERIES – Especially All Rechargeable's!!

• They need a charge cycle thus a charge and discharge circuit.
  • This is VERY important! As no charging or overcharging can cause a rupture, fire, etc.
  • YOU CANNOT JUST LET a battery ( Lithium, NiCd or NiMH) just sit in a device without expecting failure, sooner or later.
  • You need some notification of the condition of the batteries charge state
  • You need to know that it needs replacing or a serious rupture and/or fire can occur.
    • If it ruptures you can have serious caustic situation in the air and in the chemical spill
    • The older a battery gets the higher potential for a failure and rupture
      • United States Consumer Product Safety Commission (CPSC)
        • When burning, a battery/cell can reach temperatures of 700C+
          • That will easily burn through aluminum and almost anything else
          • During and after burning there will be not only hazardous/poisonous gasses but a dangerous caustic spill!

LMTV | Cyber Crime: What You Don't Know Can Hurt You (by Tim O'Neill)

This Google hangout video was produced by Man'ority Report.

"You can do anything if you put your mind to it." True for a 15-year old immigrant boy who didn't speak English but ended up being an university professor and a successful entrepreneur. That's the American dream. Unfortunately it is also true for a bunch of religious fanatics who hijacked civilian transports and turned them into flying molotov cocktails. That's the American nightmare. It wouldn't take much to start cyber terrorism. Similarly, as parents, our worse nightmare is when we say goodnight to our kids and they go into their private bedrooms and turn on their computers. +Tim O'Neill did a fantastic job today giving us an overview of cyber crime. You can run. You can hide. But what you don't know can and will hurt you.

#Man16 #LMTV +Denny K Miu

DEFT 7.1 Introduction and Videos (by Casey Mullis)

Why do I need a forensically sound  image?        What is a forensic image?

What makes up a forensic image?       How do I make a forensically sound Image?

The questions listed above are four that we are going to answer here today, before we go any further in to DEFT 7.1

What is DEFT 7.1? DEFT is a very professional and stable system that includes excellent hardware detection and the best free and open source applications dedicated to Incident Response, Cyber Intelligence and Computer Forensics. It is one tool in many an investigator should have!

DEFT is meant to be used by:

• Military
• Police
• Investigators
• IT Auditors
• Individuals

And DEFT is 100% made in Italy

DEFT 7 is based on the new Kernel 3 (Linux side) and the DART (Digital Advanced Response Toolkit) with the best freeware Windows Computer Forensic tools. It’s a new concept of Computer Forensic system that use LXDE as desktop environment and WINE for execute Windows tools under Linux and mount manager as tool for device management.

English manual can be downloaded  - http://www.deftlinux.net/doc/EN-deft7.pdf

Do you know who is in your Home? (by Tim O'Neill)

Do you know who is in your home?

Then why do you not know who is in your network and applications and what data they have access to?

In our modern day networks we pass trillions of bits, bytes and frames of data through our networks ever minute, 24 hours a day and 365 days a year. Most of the data we pass has some degree of confidentially either for ourselves or for our company. Almost anyone can tell you who is in their homes, then why do most of our network managers not know who is in their network, doing what and using what applications. Are users sticking to your network security policies and procedures? Are they leaving connections up while they go for a break or lunch or even worse until tomorrow? Are some users getting into applications and data that they are not supposed to have access to?...the list can go on and on and with the tremendous amount of data that is passed, the huge amount of internet and intranet pages browsed, the number of records accessed….etc keeping up with these answers and even just a basic network efficiency view seems like an impossible task……well it can be daunting but with the correct technology all these questions can be answered and tracked with more ease then one would imagine and can allow us to make use of even the most basic of technologies to get extremely clear views of our networks, applications and users.

Do not loose your company's important Data to a Thief!

I would like you to consider my seven important points about REAL Visualization and the value of TAP and Filtering technology -  

First – anyone one that wants to perform real network monitoring and analysis must have access to all the REAL data that flows, the good, bad and ugly in relative time! The only real way to achieve is to have TAP access to your network flows, Why TAPs – well you might want to read an older article that is used by many universities - http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html  , to reveal the truth about TAP versus SPAN and the other under achieving methods of acquiring network information.

Internet Filtering: A Powerful Tool for Business or Oppression (by Jim MacLeod)

Today, the Internet can be an infinite resource, allowing people access to a plethora of information and news. People graduating from college now have never known a world without Internet access, and it’s usually been unrestricted. However, whoever controls the network connections can potentially control the network content. And whether that control is in the hands of a company choosing to restrict certain websites or a national government enforcing its internal philosophy, free rein can be quickly taken away.

Network content control is a controversial issue.  Many companies in the United States choose to implement some level of Internet filtering.  Obviously, web browsing can be a huge distraction – how many times have you done non-work related browsing while on the job?  There are also more compelling business reasons to limited Internet browsing: US courts have ruled that merely allowing access to content which is “adult” or NSFW (Not Safe For Work) can be considered evidence in sexual harassment or discrimination lawsuits for contributing to a hostile work environment.

Then there’s the basic issue of cost: a company has to choose whether to pay more money for a faster Internet link, and if recreational traffic takes a significant portion of that bandwidth, the decision is essentially whether to subsidize personal Internet use at the company’s expense. A company makes a similar decision regarding whether to provide free coffee. There are a lot of issues, and it’s easy for employees to forget that the Internet at work is a perk, not a right.

Steganography - The Technology for Hiding (by The Oldcommguy)

What did you say?  Bless you? 

I have decided to write several articles on the Cyber Forensics World for the LMT Readers. 

The first article will be on Steganography or How to hide in Plain Sight –

 Steganography comes from the Greek word steganos or hidden/concealed writing and dates back to Greek times but did not become readily known until 1499 when Johannes Trithemius (German) wrote his book Steganographia which turned out to be a thesis on cryptography and steganography disguised as a book on magic.

 Today, Steganography gives one the ability to hide/conceal something like data, documents or pictures (the payload) inside other written material or pictures.

It is rapidly becoming a preferred method of passing/delivering criminal and or terrorist written material and pictures without easy recognition.

 It is in essence a form of magic with words, numbers and pictures as well as physical objects and of late data networking.

 There are several methods of data networking Steganography –

Having to Buy TAPs is not a Bad Problem (by The TAPman)

Take the test to see if you are a TAPaholic!

 Take the test to see if you qualify as a Certified TAPaholic!

Note from Author and Technical Editor- Not all addictions or obsessions are bad and most should be taken seriously, like drug, alcohol, and many others that are life threatening.

There are also good addictions, and one that we feel, tongue in cheek, all network managers should catch: Tapping, or focusing on getting real visibility into their network, so they can finally really see what is going on!  There are many reasons to become a “TAPaholic” and all of them are good!

So this article is about a good addiction or obsession – becoming a “TAPaholic,” really getting to know your network, and helping those “SPANaholic’s” get a better path in their professional life so they, for once, can see what is really in their network!

So you bought your first TAP to review and solve your compliance problems.  You became a hero for solving that problem and it hardly cost anything.  Now, you’re wondering how many more problems you can find using TAPs.  You’ve taken this first step for “TAPification” of your network, but you may be in danger of becoming a “TAPaholic.”

From now on you will have to be extremely careful or else you may fall into the TAP abyss.  There are still so many problems to solve on your network.  You have in-line appliances that can kill your live traffic if they should fail, and every time you need to apply software patches, you need to reserve a maintenance window.  Worrying about it keeps you and your colleagues up at night. 

But now that you bought your first TAP, you begin to wonder:

1. Could a TAP solve that in-line appliance access problem for me? 
2. Can I safely place an active security appliance on my most critical links?
3. Can I do so without the worry of losing our critical “bread and butter” link in the event that anything goes wrong with the security appliance?
4. Can I do software upgrades and maintenance on the security appliance without having to schedule a maintenance window for the critical link?

I am The TAPman and I’m here to tell you, YES!  Yes, you can! 

Keep Reading and Take the TAPman Test!

 

Why Invest in a Product that is Built Around a Modular Design? (by George Bouchard)

Why is Modularity important when considering purchasing a network access product? Well, for example, it may not be practical to design a house in a modular fashion, but if it were practical, then you could build your house exactly the way you wanted it for your needs today.  And if you only had the need for two bedrooms today, you could design it that way.  As your family grew, you could then add more bedroom modules to accommodate the growth of your family or your mother-in-law coming to live with you.

 
Modularity gives you flexibility…you only have to purchase what you need today, and you can add or change functionality as your needs expand. 

So, when considering equipment to provide Network Access for the tools you need to keep your network safe, secure, and in compliance; it would be wise to consider Network Critical’s SmartNA (Network Access)System.

The SmartNA System will give you the flexibility you need to solve your network access problems today and is so flexible it can be changed to meet your needs of tomorrow.

When it comes to networks, you can guarantee one thing -- the network will GROW.

 

It always does. Even in the smallest of networks, like the one you have in your home, will grow and change.  You will need to add tools and access more links.

 

Security, Forensics and the Database (by Jim Bailie)