Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 48 guests online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Network Forensic tools/practice/techniques
EH-Net
May 24, 2012, 10:00:33 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Network Forensic tools/practice/techniques  (Read 5709 times)
0 Members and 1 Guest are viewing this topic.
charlottebandit
Newbie
*
Offline Offline

Posts: 49


View Profile
« on: December 31, 2008, 03:12:57 PM »

How are you guys doing?  I was wondering what kind of tools are used to investigate networks to include routers, switches, firewalls, IPSs, and other advanced security technologies?  Does this mostly consist of reading each line of syslog info?

Just how far ahead or behind are the professional tools out there for this?

Logged

MS, CCSP, CCNP, CCDP, CEH, CHFI, CPTS
adamj
Newbie
*
Offline Offline

Posts: 14



View Profile
« Reply #1 on: January 02, 2009, 10:59:42 PM »

Hi.  There's a tool called Firewalk which may be worth checking out, and there's a tool which looks like it's designed to audit Cisco firewalls/routers called Router Audit Tool; see http://www.cisecurity.org/bench_cisco.html
Logged
jimbob
Guest
« Reply #2 on: January 06, 2009, 07:36:57 AM »

Does this mostly consist of reading each line of syslog info?
You could consider splunk for processing log files from network devices.

http://www.splunk.com/
Logged
timmedin
Sr. Member
****
Offline Offline

Posts: 470



View Profile WWW
« Reply #3 on: February 14, 2009, 01:52:48 PM »

These sytems are called SEM, SIM, or SIEM (Security [Event] [Incident] Management) systems that will correlate, monitor and alert on logs. This type of system will take logs and parse it for you and make drilling into (or detecting) and issue much easier. There is no realistic way you can monitor your the tremendous amount of log data without something to help you out.

Logged

twitter.com/timmedin | http://blog.securitywhole.com
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.104 seconds with 22 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.