LoveMyTool - Open Community for Network Management and Monitoring

Real Visualization for Network Professionals (by The Oldcommguy)

TAP or SPAN (RSPAN)

By: Tim O’Neill – The Oldcommguy™

Author’s comments:

• All Rights are reserved – Copyright 2013 by The Oldcommguy™!
• No one may repost this article without receiving permission!
• If permission is given then it must be posted as it is, in full context, WITHOUT any changes!

This is an updated version of my original article that was written in 2007 –

http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html

A Super Video Class from Sharkfest by a world class Trainer and Analyst – Betty DuBois –

http://blip.tv/lovemytool/span-port-vs-tap-by-betty-dubois-2290452

and part of the Ixia Team Blog –

http://blogs.ixiacom.com/ixia-blog/to-span-or-to-tap-that-is-the-question/ 

 The goal of Network, Security, Compliance, and Application managers requires FULL visualization of the Network and the packets therein!

Real Visualization is EVERYTHING!

If you cannot see an issue, like an attack, misusage, inefficiency, etc., then how are you going to understand it and resolve it? Here are the REAL facts about needing REAL TAPs!

Batteries in my TAP, in my Network, What are you thinking? (by The Oldcommguy)

There is a new trend of putting batteries in network access devices that I am really not sure of, so here are my thoughts as well as some very sobering and REAL documented issues!

 First let’s talk about the reality of batteries, ALL BATTERIES – Especially All Rechargeable's!!

• They need a charge cycle thus a charge and discharge circuit.
  • This is VERY important! As no charging or overcharging can cause a rupture, fire, etc.
  • YOU CANNOT JUST LET a battery ( Lithium, NiCd or NiMH) just sit in a device without expecting failure, sooner or later.
  • You need some notification of the condition of the batteries charge state
  • You need to know that it needs replacing or a serious rupture and/or fire can occur.
    • If it ruptures you can have serious caustic situation in the air and in the chemical spill
    • The older a battery gets the higher potential for a failure and rupture
      • United States Consumer Product Safety Commission (CPSC)
        • When burning, a battery/cell can reach temperatures of 700C+
          • That will easily burn through aluminum and almost anything else
          • During and after burning there will be not only hazardous/poisonous gasses but a dangerous caustic spill!

LMTV | Cyber Crime: What You Don't Know Can Hurt You (by Tim O'Neill)

This Google hangout video was produced by Man'ority Report.

"You can do anything if you put your mind to it." True for a 15-year old immigrant boy who didn't speak English but ended up being an university professor and a successful entrepreneur. That's the American dream. Unfortunately it is also true for a bunch of religious fanatics who hijacked civilian transports and turned them into flying molotov cocktails. That's the American nightmare. It wouldn't take much to start cyber terrorism. Similarly, as parents, our worse nightmare is when we say goodnight to our kids and they go into their private bedrooms and turn on their computers. +Tim O'Neill did a fantastic job today giving us an overview of cyber crime. You can run. You can hide. But what you don't know can and will hurt you.

#Man16 #LMTV +Denny K Miu

DEFT 7.1 Introduction and Videos (by Casey Mullis)

Why do I need a forensically sound  image?        What is a forensic image?

What makes up a forensic image?       How do I make a forensically sound Image?

The questions listed above are four that we are going to answer here today, before we go any further in to DEFT 7.1

What is DEFT 7.1? DEFT is a very professional and stable system that includes excellent hardware detection and the best free and open source applications dedicated to Incident Response, Cyber Intelligence and Computer Forensics. It is one tool in many an investigator should have!

DEFT is meant to be used by:

• Military
• Police
• Investigators
• IT Auditors
• Individuals

And DEFT is 100% made in Italy

DEFT 7 is based on the new Kernel 3 (Linux side) and the DART (Digital Advanced Response Toolkit) with the best freeware Windows Computer Forensic tools. It’s a new concept of Computer Forensic system that use LXDE as desktop environment and WINE for execute Windows tools under Linux and mount manager as tool for device management.

English manual can be downloaded  - http://www.deftlinux.net/doc/EN-deft7.pdf

What do I need to know about Photons, Fiber Optics and Networking with Light? (by Tim -The Oldcommguy)

This will be part one of a three part overview and we will start with

“What is a Photon”?

The Electromagnetic Spectrum in Hertz

The basics - A Photon is a particle of energy, a result of radiation denoted in physics by the symbol γ or gamma. Photons simply are light particles and oscillate at different frequencies giving us the visible Spectrum of light from Red (longest wavelength) to Violet (moving into the Ultraviolet or shorter wavelength). We humans only see a small part of the light (or Electromagnetic radiation) spectrum, usually in the 400 to 790 terahertz range (380 nm to 760 nm). White light is a combination of different wavelengths of light combined.

These days we hear a lot about lasers, especially in the data communications arena.

What is a laser?

LASER stands for Light Amplified by Stimulated Emission of Radiation.

Do you know who is in your Home? (by Tim O'Neill)

Do you know who is in your home?

Then why do you not know who is in your network and applications and what data they have access to?

In our modern day networks we pass trillions of bits, bytes and frames of data through our networks ever minute, 24 hours a day and 365 days a year. Most of the data we pass has some degree of confidentially either for ourselves or for our company. Almost anyone can tell you who is in their homes, then why do most of our network managers not know who is in their network, doing what and using what applications. Are users sticking to your network security policies and procedures? Are they leaving connections up while they go for a break or lunch or even worse until tomorrow? Are some users getting into applications and data that they are not supposed to have access to?...the list can go on and on and with the tremendous amount of data that is passed, the huge amount of internet and intranet pages browsed, the number of records accessed….etc keeping up with these answers and even just a basic network efficiency view seems like an impossible task……well it can be daunting but with the correct technology all these questions can be answered and tracked with more ease then one would imagine and can allow us to make use of even the most basic of technologies to get extremely clear views of our networks, applications and users.

Do not loose your company's important Data to a Thief!

I would like you to consider my seven important points about REAL Visualization and the value of TAP and Filtering technology -  

First – anyone one that wants to perform real network monitoring and analysis must have access to all the REAL data that flows, the good, bad and ugly in relative time! The only real way to achieve is to have TAP access to your network flows, Why TAPs – well you might want to read an older article that is used by many universities - http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html  , to reveal the truth about TAP versus SPAN and the other under achieving methods of acquiring network information.

Extra! Extra! Read all about it!!!! Lovemytool.com honored! (by Tim O’Neill)

Lovemytool.com is chosen by NetworkWorld as one of the 15 more useful Cisco sites!

By: Jim Duffy of NETWORKWORLD - Another lineup in our continuing search for the most useful sites on the Web for Cisco users and practitioners.

Original article link - http://www.networkworld.com/slideshow/66329/?source=NWWNLE_nlt_cisco_2012-09-26#slide15

Operation New Son (OpNewSon) – Are you ready??? This could happen to you! (by- Tim O'Neill)

Time to Prepare - Are you ready???

The FBI and international Law Enforcement are warning major companies World Wide of an impending DDOS attack on May 25^th.

Operation New Son  - Tomorrow May 25th, 2012 – Download Operation New Son FBI announcement 

Here is one of the attackers posts of their intention and info - http://pastebin.com/wq6KdgDg

This site also give hints of more info on Twitter, who may block the announcment tweet names –

@AnonymousWiki  - @AnonymouSpoon  - @MehIzDanneh  - @TibitXimer  - @Anonymau

They are asking for your help in attacking their targets.

I propose that it is NOT a good idea to neither support nor cause an attack, as you will be prosecuted!

"Should I go" Challange - Wireshark Training in Austin, Texas

As everyone knows Wireshark is the ultimate Open Source network and data packet visualization tool.

So can you find the three problems in the traces below....The Challange Begins!!

Every Network Engineer should know Wireshark inside and out regardless of the commercial tools they use. Here is an incrediable oportunity for those in and around Austin, Texas, capitol of the Great State of Texas!

 

Should you Go to this Class - Well lets look at some of the things you will learn about...see if you know the answers of what is in these Wireshark traces -

What do you see that is a problem in this filtered Wireshark trace????

Answer -  that you will learn in the class-

This is what it looks like when another 10mb device’s preamble overwrites another packet.

The preamble pattern of 1010 works out to be A and 0101 is 5.

Probable cause: half/full duplex mismatch 

Ok, Do You Want To Try another trace -

 

Do we need a license??? How do we assure safety for our Children in the Wild West of the Internet?(by Tim O’Neill)

I wonder why we need licenses and age limits on everything that we can experience in life, from driving to drinking, except using the Internet?

We protect our Children from driving when they are under 16 and to try to stop them from drinking and smoking before they are old enough to make adult decisions. You cannot start a business without a license or practice medicine and many other adult behaviors!

 There is one major variant to those common rules of access– Having access to the Internet, the 21^st Century Wild West Adult Show.

I am not proposing that we require an age limit, test and license, much less a tax or limits on access to the Internet.
I am curious why parents just give their kids access to a computer and turn them loose in this very adult and proven dangerous environment?

As an ICAC (Internet Crimes against Children), longtime Internet Safety instructor and Cyber investigator and Trainer, I have seen my share of events that have left me to ponder why we seem to put Internet Safety as the last thing we think of, until there is a problem. Don't we lock our doors and cars to keep out strangers and trouble ? Ok why then do we alllow the children open access and they can invite strangers and danger into your locked house??? Then when there is a problem we instantly blame everyone, except ourselves. We call the police then demand and hope for them to solve the issues but as parents we hold the majority of the blame for internet issues because we did not take any time to coach and watch over our kids, but we almost always blame the failure of society, the schools, teachers, police, law makers…etc but not the parents!!!

 Important Rule #1 - No one is responsible for your children and their behavior except you, the parents!