4.5. Anomalies settings

Packet sniffer is more a troubleshooting tool than a specific tool for constant netflow monitoring. Packet sniffer allows you to capture every packet and store it on your hard disk. Let's say you want to do 24 hour monitoring - 7 days a week, this way you need an incredible big hard disk.

Netflow monitoring collects statistics not the whole packet, which is why this method is more suitable for constant monitoring.

This current software version supports base network anomaly detection such as network and host port scanning, ICMP and TCP/SYN flooding detections, and detection of network games and peer-2-peer applications. Most of the modules use heuristic detection methods - for every anomaly there is a specified probability of incident.

4.5.1. Anomalies - Collector settings

If you want to run network anomalies (NA) detection it's required that you enable the NA for every collector. NA detection consumes a lot of CPU and memory so be careful when enabling this option.

This software also enables you to specify internal network IP address ranges for every collector. If NA module detects that incident is related to the internal network it gives the anomaly higher severity. IP address range can be specified in the following formats: single IP address (10.1.1.1), domain name (web.mydomain.com), list of IP addresses (10.1.1.1, 10.2.1.1, web.mydomain.com), range of IP addresses (10.3.1.1-10.3.255.255), IP networks (10.0.0.0/8, 192.168.0.0/16), exclude range of network (10.0.0.0/8, !10.1.0.0-10.5.255.255). The list of IP addresses has to be separated by a comma.

Figure 4.11. Anomalies - Collector settings window.

Anomalies - Collector settings window.

You can configure severity of anomaly for each network module. Severity is specified as a function of probability and the number of anomaly occurrences. For example you configure 10 occurrences for important severity. Analyzing software may assign important severity if it detects more than 10 occurrences with 50% probability or 5 occurrences with 99% probability or 20 occurrences with 1% probability. Occurrence value "-1" means that you don't want to generate a severity for this anomaly.

Other settings are module dependant (for example: sensitivity, minimal number of observed destinations, used TCP/UDP ports etc).

Figure 4.12. Anomalies - Module settings window.

Anomalies - Module settings window.