Network Monitoring And Packet Analysis. A Network Monitoring

In this lab, we must add the Windows 2012 server to our monitoring server with monitoring DNS and DHCP on the Windows 2012 server. In my case, I have Nagios as the monitoring service set up. In Nagios, I added the Windows 2012 server and configured it to monitor DHCP, DNS, and the CPU of the Windows 2012 server. This is an excellent practice for Sys Admins to make sure what services are critical to watch or troubleshoot in the infrastructure.

3. Implement effective monitoring of networks through the use of electronic scanning in order to

Monitoring tools are used to continuously keep track of the status of the system in use, in order to have the earliest warning of failures, defects or problems and to improve them. There are monitoring tools for servers, networks, databases, security, performance, website and internet usage, and applications. It can be a standalone application, or function as part of firewall software or hardware, anti-virus software, or an information security software suite. Generally, monitoring software records and logs all incoming and outgoing network traffic, user processes and interactions, and application activities. It includes specific rules, signatures, events and preferences, which describe normal and abnormal system states and activities. It also signals the administrator if it identifies any violation or breach that results in abnormal system behaviour, user activity or network flow. Furthermore, such software is also used for spying on staffs or users' activities within a corporate network. Parental control is a type of monitoring software that blocks specific user activities and issues a notification to parents and administrators in case of any violations or breaches.

Organizations emphasized the use of physical security to help enable the use of physical access controls. It was reported that physical security became difficult to manage due to technology becoming complex every day (Hutter,2016). It was indicated that organization often over looked physical security until after a serious event had occurred. Per Hutter, physical security threats were either internal or external. Employees were considered external threats when they gain access to unobserved areas and were considered internal threats when their knowledge was utilized. Organizations were noted to implement the use of physical security through locked doors, access control systems (i.e. Paxton Access Inc, Identiv), alarm systems and many other important applicable measures.

Requests for monitoring network traffic, application and data access, keystrokes and user commands, and e-mail and Internet usage must be in writing and directed to the manager, CISO.

The latest Cisco IOS innovation of NetFlow of version 9 is flexible and extensible method to record network performance data. A comprehensive solution for NetFlow-based, planning, monitoring and billing can provides to customers.

Assessed if the network policy has been developed and documented based on a recognized standard.

All the network devices must be configured with the centralized logging mechanisms and the active logs must be available at least for 90 days and the older logs must be archived and stored securely for later analysis requirements.

** Anomaly detection –The anomaly detector monitors network segments to compare their state to the normal baseline and look for anomalies.

The role of network monitoring is to track how the network equipment and software perform. The monitoring software looks for hardware or performance failures and sends alerts to your admin. The admin then corrects the problem wherever possible.

Remote monitoring is a method used to interchange network monitoring data between Network Monitors and console systems. RMON offers network administrators with more liberty in selecting network-monitoring probes and consoles with features that meet their precise networking requirements. RMON is an Internet Engineering Task Force (IETF) standard monitoring requirement document that allows numerous network agents and console systems to exchange network monitoring data. A typical specification of RMON would be that in which Simple Network Management Protocol (SNMP) agent in a switch be to monitor all the traffic flowing among switches on connected LAN nodes / segments.

Monitoring tools are used to continuosly keep track of the status of the system in use and involved to have a

The very first step in auditing networks is to define where to analyze the traffic. Taking a common scenario for analysis, the following assumptions were made. There is a switched network made up of a number of switches, several terminals and a file server. Network performance has dropped, however the cause is unknown. There is no IDS (Intrusion Detection System) that can alarm or inform about attacks or network malfunction. Also, it is known that there are no problems with the transfer rate of the file server to LAN (Local Area Network) terminals [3]. Furthermore, network equipment does not have Netflow protocols to analyze traffic remotely. Wireshark was chosen to analyze the above scenario. The first doubt which arises is where to install Wireshark. It would seem logical to install Wireshark on the file server itself to analyze the traffic that flows through this network segment. However, there could be situations in which there is no access to the server physically or quite simply for security reasons. Thus, Wireshark cannot be installed there. Some alternatives are provided in the following paragraphs that enable to capture traffic without having to install Wireshark on the server.

Traditional monitoring methods can be referred to as first generation of monitoring. The traditional methods of monitoring were mainly concentrated on infrastructure monitoring. Hence this method was also called as watching infrastructure method. Infrastructure monitoring attributes like server uptime, server load, network devices, storage etc were used to identify the root cause of an issue. In this method log files and errors are copied to text files. Sytem administrators had to look at these files using software like notepad or spreadsheet software whenever something goes wrong. They needed to examine these logs and errors to identify what has caused the problem. Traditional methods involved tedious tasks to perform monitoring service and it was more time consuming. Most of the works had to be performed

The high level design of modern home/office network monitoring is illustrated in the diagram below.