Overview
Syllabus
Intro
Jason Smith
Applied Network Security Monitoring
Agenda
Full PCAP vs. Flow Data
Building Flow Records
Generating Flow Data
Collecting Flow Data
Flow Data Tool Comparisons
SILK Collection Architecture
Getting Started with Flows
SILK - Install
SILK Analysis - rwfilter / rwcut
SILK Analysis - PCAP Conversion
SILK Analysis - Output Examples
FlowBAT - Install
FlowBAT Analysis - Filtering
FlowBAT Analysis - Stats
FlowBAT Analysis - Dashboard Using the 24 hour graph and periodically executing
FlowBAT Analysis - Non-Standard Ports Discovering outbound data to applications using nonstandard ports.
Identifying Services
Analyzing PCAP Files PCAPs need to exist on the FlowBAT server
Network Flow Automation
Flow Plotter
Conclusion