Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want/need to start monitoring our network a bit better. Its an odd network in that it comprises 2 /22 public IPs and a slew of private admin IPs. I do have one point in the network where it all comes together and I can turn on port mirroring on the catalyst. From that port, I'd like to turn up a box running various utilities. Snort is high on my list but it'd be nice to also get some networking statistics with something like Netflow.

So, what are peoeple's thoughts. I can turn up a box needed for this with a bit of ease. We have the hardware available. What should I run? I'd love to know what kind of nasty things are potentially going on but I'd also like to see statistics on what people are doing on the network so I can better tweak our systems to handle it better and improve performance.

I'm open so please, give me some ideas to go along with what I've got.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

That is the perfect spot to do some sniffing. If you're willing to put in the time to tune snort so it is useful (it isn't out of the box, w-a-a-a-y too noisy) it can be both educational AND useful! A double win.

I'm fuzzy on the details but we're pulling net-flow data out of our Cisco gear and aggregating them on a specific box for analysis. It isn't the same box we're running our IPS on, but it's very close to it network-wise. Flow-data is also very useful, and not just for finding the people up/downloading .iso files.

share|improve this answer

You might also want to take a look at this: http://www.linux-magazine.com/Issues/2009/109/Security-Lessons/%28kategorie%29/0, capture and store network traffic, you can then replay and dissect it at your leisure. Assuming your network links aren't to large you can easily buffer a day or two of traffic and have something to examine should you discover an attack.

But start with Snort and tune it until the noise goes away for sure!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.