Practical Network Scanning

Threat detection with Netflow/IPFIX

When looking at cloud scale and high speed data networks, the trend is to monitor and trigger events for suspicious flows based on NetFlow and IP Flow Information Export (IPFIX). Most network devices, routers/switches, and firewalls support NetFlow and IPFIX. These flow methods make the data traffic passing through devices visible. You can relate these methods to Wireshark capture, which holds information such as source IP, destination IP, and TCP/UDP ports. Wireshark capture works in a similar way to a phone call recording, while flows are the call logs containing metadata information. A flow reporting system continuously monitors flows and has the ability to connect host reputation databases in order ...