CIS 527
Lecture 10 - Network Monitoring
Network Monitoring
- Advanced IP Scanner
- TCPView
- Netstat
- Nmap
- SNMP
- Wireshark
- Cacti
Advanced IP Scanner
Advanced IP Scanner
Advanced IP Scanner
- Query unknown networks
- Learn location of systems
- See what resources and services are running
TCP View
TCP View
TCP View
- See current connections
- Analyze network traffic on Windows
- Show actively listening servers
Netstat
Netstat
- See current connections
- Analyze network traffic on Linux
- Show actively listening servers
Nmap
Nmap
- Actively scan all aspects of a network device
- Analyze open ports and available servers
- Audit security of machines
Simple Network Management Protocol (SNMP)
- Interface for querying inforamtion from network devices
- Can also be used to modify settings
- Commonly used as a monitoring tool to gather information from a variety of devices and servers
Simple Network Management Protocol
SNMP MIB and OID
- MIB = Management Information Base
- OID = Object ID
- SNMP requests and responses use a coded system to identify information
- 1.3.6.1.2.1.5.1 = icmpInMsgs
- http://www.alvestrand.no/objectid/
SNMP Activity
- Log on to CIS Linux
- Use SNMP to query the number of ICMP messages sent
- Use SNMP to query the number of SNMP messages received
- Use SNMP to find the interfaces available on the system
- Use SNMP to find the IP addresses of the system
Wireshark
- Used to capture and analyze individual packets
- Useful for both monitoring and forensics
Wireshark
Wireshark Activity
- Capture ICMP (Ping) Packets
- Capture HTTP Packets
- Recover data from HTTP Packet
- See entire TCP Stream
- Capture HTTP Authentication
Assignments
- Lab Help Session Fridays 9 - 10 AM!
- Lab 3 - Networking Services - Due Sunday, Mar 9th by 11:59 PM
- Set up Core Network Services & Network Monitoring
- Turn in:
- CIS Transient Storage
- via Storage Media in class Monday Mar 9th