Network forensic tools
Home > IT Answers > Security > Network forensic tools
JennyMack
3330 pts.
0
Q:
Network forensic tools
Network forensics, Network monitoring, Network Monitoring Tools, Network administration
What tools do you use to perform network forensics? Do you have any favorites, and why?
ASKED: Jun 30 2009  9:03 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
BlankReg
11280 pts.
0
A:
 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0
  • AddThis Social Bookmark Button
My advice is to basically log everything you can, and make sure you also use NTP on everything so the times are all synchronised. We set everything to GMT, and never change to summer time (daylight saving), so it is clear when events happen.

Use syslog for most devices, and archive the logs from those that generate them. Make sure you also have the start/stop records from any RADIUS server, also making sure that this is used to authenticate access to the network and any devices.

To analyse this data I usually just do it manually. I have not really found any good tools, other than the Cisco MARS, but that is a bit too expensive for the network I manage (and for the manager's I work for !).

most times when I have had to look at incidents, it is over a fairly restricted timeframe, and it is focussed on certain devices, so a manual trawl through the data is not as horrible as it could be. With everything timestamped, and synchronised, it is made a lot easier.

Just my 2p (2c) worth :-)
Last Answered: Jul 1 2009  7:27 AM GMT by BlankReg   11280 pts.
Latest Contributors: JimmyIT   1260 pts., ETERNALNY   20 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

KevinBeaver   7610 pts.  |   Jul 1 2009  12:13AM GMT

I’ve always recommended people not overlook a good old-fashioned network analyzer such as OmniPeek and CommView for incident response. A hex editor such as WinHex and a data recovery tool such as Davory are good things to have in your toolbox as well.

 

Troy Tate   0 pts.  |   Jul 23 2009  8:02PM GMT

It depends on the environment and requirements. A simple tool like ntop can help track usage over a period of time or Wireshark (tshark) can be used to capture ring buffer files and details can be captured over a set period of time for analysis.

 
0