Network Monitoring and Security Techniques

Networking Monitoring
Objectives:
● 1.2 - Compare and contrast networking appliances, applications, and functions
● 3.2 - Given a scenario, use network monitoring technologies
● Intrusion Detection and Protection Systems (IDS/IPS)
○ Intrusion Detection System (IDS)
■ Detects network threats
■ Passive device
■ Monitors network traffic, logs, and alerts
○ Intrusion Prevention System (IPS)
■ Detects network threats and responds to them
■ Active device
■ Operates in line, blocking offending traffic
○ Snort
■ Software-based IDS/IPS
■ Open-source and widely used
○ Challenges with IPS
■ False positives can lead to blocking legitimate traffic
311
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Detection Methods
■ Signature-based
● Matches unique byte strings or patterns
■ Policy-based
● Relies on specific security policies
■ Anomaly-based
● Statistical
○ Watches traffic patterns to build baseline
● Non-statistical
○ Administrator defines the baseline
○ Network-based vs. Host-based IDS/IPS
■ Network-based – protects entire network
■ Host-based – installed on individual hosts
■ Combination of two can provide more protection to the network
● Simple Network Management Protocol (SNMP)
○ Simple Network Management Protocol (SNMP)
■ Internet protocol for collecting, organizing, and modifying information
about managed devices on IP networks
■ Can be used to change device behavior
○ Managed Devices
■ Devices communicating with an SNMP manager (MIB)
312
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ SNMP Architecture
■ SNMP Manager
● Any machine on the network that is running the SNMP protocol to
collect and process information from the devices
■ SNMP Agents
● Network devices sending information to the manager
○ Message Types
■ Set
● Manager request to change variable values
■ Get
● Manager request to retrieve variable values
■ Trap
● Asynchronous notifications sent from agent to manager
● Used for event/alarm notifications
● Encoding methods:
○ Granular Trap
■ Each SNMP trap message is sent with a unique
Object Identifier (OID)
■ Object Identifier (OID)
● Identifies a variable that can be read or set
via SNMP
313
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Consolidated and stored in Management
Information Base (MIB)
■ Management Information Base (MIB)
● Describes the structure of the management
data of a device subsystem using a
hierarchical namespace
○ Verbose Trap
■ SNMP traps may be configured to contain all the
information about a given alert or event as a
payload
○ SNMP Versions
■ SNMPv1
■ SNMPv2
● Both v1 and v2 use community strings sent and stored in plain
text, making them insecure
■ SNMPv3 – most secure
● Integrity – hashing messages to prevent alteration
● Authentication – validating message sources
● Confidentiality – encryption using DES (Data Encryption Standard)
or newer standards like 3DES and AES (Advanced Encryption
Standard)
● Groups SNMP components for increased security
314
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Allows different access privileges (read, write) for different group
● Enhances network protection and management
● Network Sensors
○ Network Sensors
■ Monitor device performance (e.g., routers, switches, firewalls)
○ Temperature Sensor
■ Reports device chassis temperature
■ Minor Threshold –indicates rising temperature
■ Major Threshold – signals dangerous conditions
■ Actions:
● System messages
● SNMP notification
● Load Shedding
○ A device can turn off different functions to reduce
temperature
■ Excessive heat reduces performance, lifespan, may cause failure
○ CPU Usage/Utilization
■ Normal range – 5% to 40%
■ High utilization
● Possible causes:
○ Misconfiguration
315
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Network attacks
● Consequences:
○ Packet drops
○ Connection failure
○ Memory Utilization
■ Thresholds:
● Minor
● Severe
● Critical
■ Normal operation – around 40%
■ Busier times – 60% to 70%
■ Peak times – Up to 80%
■ Above 80%
● Device capacity may have to be adjusted
● Could indicate network attack
● Implications:
○ System hangs
○ Crashes
○ Real-world Operation
■ Monitoring deviations from baseline
■ Alarms for abnormal metrics
■ Investigation and resolution of issues
316
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Packet Captures
○ Packet Capture
■ Used to capture all data going to or from a network device
■ Packet Capture Columns
● Number
○ Packet number in the capture sequence
● Time
○ Elapsed time since starting the capture
● IP Addresses
○ Source IP
○ Destination IP
● Protocol
○ TCP, UDP, or other Layer 3 or 4 protocols
● Length
○ Size of the packet
● Info
○ Header information
○ Example Attacks
■ Packet Capture 1
● Port Scan
○ SYN packets are sent to various ports to detect open ports
317
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Packet Capture 2
● SYN Flood
○ Flood of SYN packets, without completing the three-way
handshake, to overwhelm a server
■ Packet Capture 3
● Distributed Denial of Service (DDoS)
○ Multiple systems attacking the same server, shown by SYN
flood attempts from different source IP addresses
○ Exam Focus
■ Exam packet captures may contain 5, 10, 15, or 20 lines (snippets),
highlighting specific attack types
■ Understanding attack types based on limited information is crucial (e.g.,
identifying a DDoS attack from multiple sources targeting the same
server)
■ Remember to focus on the key elements of a packet capture and how
they relate to different attack types, especially when information is
limited
● Network Flow Data
○ Flow Analysis
■ Recording of metadata and statistics about network traffic using flow
collector tools
318
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Do not capture the content of the network traffic like full packet capture
but provide valuable metadata for monitoring
○ Benefits of Flow Analysis
■ Allows capturing traffic flow information instead of the content, saving
storage space
■ Helps in identifying trends, patterns, and anomalies in network traffic for
performance monitoring and security
○ Tools for Traffic Flow Analysis
■ NetFlow
● Cisco-developed means of reporting network flow information to
a structured database
● Defines traffic flow based on packets that share the same
characteristics
■ Zeek
● A hybrid tool that passively monitors the network
● Logs full packet captures when something of interest is detected
based on configured parameters and rules
● Normalizes data and stores them in tab-delimited or JSON formats
○ Allows compatibility with various cybersecurity and
network monitoring tools for analysis
319
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Multi Router Traffic Grapher (MRTG)
● Creates graphs to show network traffic flows through network
interfaces, aiding in visualizing traffic patterns
● Can reveal abnormal traffic patterns that require further
investigation
● Incident Response
○ Network sniffers can be deployed to investigate potential
malicious activities, such as data exfiltration, based on
abnormal traffic patterns
○ Instant response and cleanup actions can be taken upon
identifying suspicious activities to maintain network health
and security
● Log Aggregation with Syslog
○ Network Logging Overview
■ Network devices generate logs containing information, events, warnings,
alerts, and critical data
■ For large networks, manual log review is impractical
○ System Logging Protocol (Syslog)
■ A protocol that is utilized to transmit logs to a central server, simplifying
the process of collecting logs from all routers and switches
■ Allows easier analysis and review from a single location
320
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Syslog Server
■ Centralized servers where logs from routers, switches, servers, and other
devices are sent
■ Can be standalone syslog servers or integrated
● Security Information Management (SIM)
● Security Event Management (SEM)
● Security Information and Event Management (SIEM)
○ Combines logging and analysis functionalities into one
system
■ A big collection of all the different logs from all the different servers and
clients and network devices
○ Syslog Components
■ Client
● Sends log information to the syslog server
■ Server
● Receives and stores logs from clients
■ Logs are sent over UDP using port 514
○ Syslog Severity Levels
■ Eight levels, each level indicates the severity of the log message
● 0 – Emergency
○ The system has become unstable
○ Most severe
321
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● 1 – Alert
○ A condition should be corrected immediately
● 2 – Critical
○ A failure in the system’s primary application requires
immediate attention
● 3 – Error
○ Something is preventing proper system function
● 4 – Warning
○ An error will occur if action is not taken soon
● 5 – Notice
○ The events are unusual
● 6 – Information
○ Normal operational message that requires no action
● 7 – Debugging
○ Useful information for developers
○ Least severe
■ Log Management
● Administrators determine which levels to log and how long to
keep logs
● Limiting logs to levels 0-5 is common to conserve disk space
■ Exam tip
● Study and understand the eight different severity levels of syslog
322
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Network Device Logs
■ Traffic Logs
● Contain information about traffic flows within the network
● Useful for identifying abnormal traffic patterns and
troubleshooting network issues
■ Audit Logs (or Audit Trails)
● Record sequence of events and changes on network devices
● Useful for tracking configuration changes and identifying
unauthorized modifications
○ Log Analysis
■ Analyzing logs can reveal trends and anomalies that may indicate security
breaches or network issues
■ Understanding normal network behavior is key to identifying abnormal
activity
○ Windows Logs
■ Application Logs
● Information about software running on Windows machines
● Severity Levels
○ Informational
○ Warning
○ Error
323
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Security Logs
● Information about security-related events, such as login attempts
■ System Logs
● Information about the operating system itself
● Severity Levels
○ Informational
○ Warning
○ Error
● Security Information and Event Management (SIEM)
○ Security Information and Event Management (SIEM)
■ A security solution that provides real-time or near real-time analysis of
security alerts generated by network hardware and applications
■ Helps maintain a strong security posture by collecting and analyzing logs,
informational alerts, and events from various devices on the network
○ SIEM Functions
■ Log Collection
● Gather event records from sources throughout the network,
usually using syslog
● Provides important forensic tools
● Helps address compliance reporting requirements
324
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Normalization
● Map log messages from different systems into a common data
model for analysis
■ Correlation
● Link logs and events from different systems or applications into a
single data feed
● Detects threats more efficiently
■ Aggregation
● Reduce event data volume by consolidating duplicate events into
single records
■ Reporting
● Present correlated and aggregated event data in real-time
monitoring dashboards or long-term summaries
○ SIEM Implementation
■ Software on a server
■ Hardware appliance
■ Outsourced managed service
○ Considerations for Effective SIEM Deployment
■ Log all relevant events and filter out irrelevant data
■ Establish and document the scope of events
■ Develop use cases to define threats
■ Plan incident responses for different scenarios
325
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Establish a ticketing process to track flagged events
■ Schedule regular threat hunting
■ Provide auditors and analysts with an evidence trail
○ SIEM systems use the syslog protocol to collect data from network and client
devices
■ Ports
● Port 514 – UDP
● Port 1468 – TCP
○ Exam Tip
■ Understand the purpose of SIEM, its reliance on the syslog protocol, and
its functions in collecting, normalizing, correlating, and aggregating
logging data for analysis
● Understanding SIEMs: Demonstration
● Network Performance Metrics
○ Network Performance Monitoring
■ Focuses on end-to-end monitoring of user experience, unlike traditional
monitoring which focuses on specific points.
○ Key Metrics
■ Latency
● Time taken for data to reach its destination and return
326
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Measured in milliseconds
● High latency
○ Slows down network performance
○ Especially noticeable in real-time applications like video
conferencing or gaming
■ Bandwidth
● Maximum rate of data transfer across a network
● Measured in bits per second
● Throughput
○ The actual data transfer rate achieved
○ Often lower than the theoretical bandwidth due to
network conditions
■ Jitter
● Variation in packet delay
● Particularly impactful for real-time applications
● Causes disruptions like voice speeding up or video freezing during
conferences
● Managing Jitter
○ Implement Quality of Service (QoS) to prioritize voice and
video traffic
○ Ensure network connections and devices can handle the
data volume without congestion
327
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Monitoring Responsibility
■ As a network administrator, it is important to continuously monitor these
metrics to ensure optimal network performance
● Interface Statistics
○ Interface
■ A physical or logical switch port on a router, switch, or firewall
■ In, enterprise-level devices, each interface can generate its own statistics
and maintains its own status
○ Interface Statistics
■ Provide detailed information about the status and performance of
network interfaces
■ Helps troubleshoot network connectivity issues and optimize network
performance
○ Key Elements of Interface Statistics
■ Link State
● Indicates whether the interface has a cable connected and a valid
protocol for communication
● “FastEthernet 0/0 is up, line protocol is up"
○ Indicates the interface is physically connected and
operational
328
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Speed and Duplex Status
● Specifies the interface's speed and duplex mode
● Optimal settings for fast Ethernet
○ 100BaseTX/FX
■ 100 Mbps bandwidth
■ Full duplex
■ Using either copper or fiber cabling
■ Send and Receive Traffic Statistics
● Tracks the number of packets and bytes sent and received by the
interface
■ Cyclic Redundancy Check (CRC) Statistics
● Counts the number of packets that failed the CRC check
● High CRC errors may indicate issues with cabling or
electromagnetic interference
■ Protocol Packet and Byte Counts
● Provides detailed counts of packets and bytes for different
protocols
● Input and Output Errors
○ Counts errors in received and transmitted packets,
indicating potential issues with the interface or network
329
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Additional Information Based from Cisco Router for an Interface (F0/0)
■ MAC Address and IP Address
● IP and MAC addresses assigned to the interface
■ MTU Size
● Maximum Transmission Unit size of the interface
● 1500 bytes – default for Ethernet
■ Bandwidth
● Speed of the interface
● 100,000 Kbps (100 Mbps) – fast Ethernet
■ Reliability
● Indicates the reliability of the connection
● 255/255 – best
■ TxLoad
● Indicates how busy the router is transmitting frames over the
connection and
● Example
○ 1/255 – not busy
■ RxLoad
● Show how busy the router is in terms receiving frames.
■ ARP Type
● Indicates the ARP protocol being used
● ARPA – for Ethernet
330
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Keep Alive
● Specifies the interval at which the router sends keep alive packets
to check if connected devices are still online
● 10 seconds – default
■ Input queue
● Shows the number of packets in the input queue and its maximum
size
■ Drops
● Count dropped packets
■ Flushes
● Count Selective Packet Discards (SPD)
● When the router or switch starts shedding some load and
dropping packets selectively
● Selective Packet Discards (SPD)
○ Drops low priority packets when CPU is busy to prioritize
higher priority packets
■ Queuing Strategy
● Specifies the queuing strategy
○ First in, first out (FIFO) – default for Ethernet
■ Output queue size
● Shows the current and maximum size of the output queue
331
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Input and Output Rates
● Display the average rates at which packets are being received and
transmitted
■ Packet Input and Output
● Counts the number of packets received and transmitted, along
with the corresponding byte counts
■ Runt
● An Ethernet frame that is less than 64 bytes in size
■ Giant
● Any Ethernet frame that exceeds the 802. 3 frame size of 1518
bytes received
■ Throttle
● Occurs when the interface fails to buffer the incoming packets
● High number indicates quality of service issues
■ Input errors
● Counts frames received with errors
■ Frame
● Counts packets with CRC errors and a non-integer number of
octets
■ Overrun
● Counts times when the interface was unable to receive traffic due
to insufficient hardware buffer
332
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Ignored
● Counts packets ignored due to low internal buffers
● Rises drastically when connection is experiencing noise or a
broadcast storm
■ Watchdog counter
● Counts times the watchdog timer has expired
● Happens whenever a packet over 2048 bytes is received
■ Input Packets with Dribble Condition
● Counts frames slightly longer than the default frame size (MTU
size, 1500 bytes) but not yet a giant (1518 bytes)
■ Packet Output Counter
● Number of packets that have been sent and the size of those
transmissions in bytes
■ Underrun
● Counts times when sender operated faster than router can handle
● Causes buffers or dropped packets
■ Output Errors
● Counts collisions and interface resets
● Collision
○ 0 – full duplex
○ not zero indicates something is wrong
333
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Unknown Protocol Drops
● Counts packets dropped when the device couldn't determine the
protocol
■ Babble
● Counts any frame that are transmitted and larger than 1518 bytes
■ Late Collision
● Counts the number of collisions that occur after the interface has
started transmitting its frame
● 0 – full duplex
● not zero – half duplex
■ Deferred
● Counts the number of frames that were transmitted successfully
after waiting
● 0 – full duplex
● not zero – half duplex
■ Lost Carrier and No Carrier
● Counts times the carrier signal was lost or not present during
transmission
■ Output Buffer Failure
● Number of times a packet was not output from the output hold
queue due to shortage of shared memory
334
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Output Buffer Swapped Out
● Number of packets stored in the main memory when the queue is
full
● High number indicates busy time in the network
○ Exam Tips
■ Focus Areas
● Link state, speed and duplex status, traffic statistics, CRC errors,
and common error types (e.g., giants, runts)
■ Scenario-Based Questions
● Be prepared to analyze interface statistics to troubleshoot
network issues
■ Sample Troubleshooting Using Interface Statistics
● Slow Network Performance
○ Check duplex settings and for excessive collisions or errors
● CRC Errors
○ Inspect cabling and connectors for damage or interference
● Collisions
○ Investigate network segments with multiple devices or
network congestion
● Input and Output Errors
○ Look for issues with the interface or network configuration