Network Traffic Analysis (NTA) - The First Step in Intrusion Detection! (Andrey Yesyev)

 

Next-generation intrusion detection systems (IDS) are supplanting their legacy predecessors to provide complete security for complex networks. This new breed of security solutions take advantage of intelligent data and machine learning to provide full network traffic analysis (NTA).

NTA actually is a term coined by research firm, Gartner. 

The company defines NTA as a way to separate legacy (mostly layer 3 technology) from next-gen layer 7-based technology – what that means is that NTA analyzes network activities intelligently to provide comprehensive security.

NTA now is inextricably linked with modern IDS solutions, relying on intelligent data and machine learning to offer full visibility of the network. It works in tandem with, or is complementary to, perimeter protection offerings to provide a holistic view of the entire network, within and beyond the network’s edge.

Empathy: A Requiem (Paul Smith)

 

It was the summer of 1977 when I drove with my fiancé’s younger brother to the Hollywood Boulevard Walk-of-Fame. Neither of us was that impressed with the famous names on the sidewalk; we were there to stand in line at Mann’s Chinese Theater for the very first Star Wars movie. These were the days when Hollywood was still a thing, and Mann’s (built in 1927) was a historic place to see a film. It also boasted of the revolutionary new THX sound system. We were blown away before the opening crawl.

That was a long time ago...

TCP Checksum Errors in Wireshark: Are They Real? How to Tell False Positives from Actual Packet Corruption

Protocol analysis is an ever changing art because of 2 significant variables:

Protocols 

Every time an application gets an update it might affect the way it interacts with protocols.  

Operating system upgrades may change the actual protocols, behavior or drivers.  

Certain applications might come with its own ‘built in protocols’ 

Tools 

Understanding Duplicate ACKs in TCP: A Wireshark Walkthrough with Chris Greer

Unlock the Mystery of Duplicate Acknowledgments in TCP

If you've ever stared at a Wireshark capture wondering why you're seeing a flood of duplicate acknowledgments, this video by networking expert Chris Greer is exactly what you need. In this focused, no-fluff tutorial, Chris breaks down one of the most commonly misunderstood behaviors in TCP/IP traffic analysis — duplicate ACKs — and explains not just what they are, but why they appear and what they're telling you about your network.

Perfect for Troubleshooters at Every Level

Beyond Ping: Using TCP Connect, Traceroute, and Response-Time Graphing to Troubleshoot Network Connectivity

Ask any network pro about which command line tool they use the most – likely ping is near the top of the list, which makes sense. Ping has stood the test of time as a quick way to validate the network path between two endpoints.

But what if it fails? What can we do next?

When a ping is successful, we quickly can validate for at least that moment, we have a working path to the target station, routing is working, and basic connectivity is established. However, it is possible to have a successful ping even when underlying layer one and two issues are there - as these problems may not impact every single frame that traverses them.