Notes - MIECT
Segurança Em Redes De Comunicações
Notes - MIECT
Segurança Em Redes De Comunicações
  • Segurança Em Redes De Comunicações
  • Corporate Networks Topics
    • Objectives of Network Design
    • Equipments
    • Hierarchical Network Model
    • Modular Network Design
    • Designing the Access Layer
    • Designing the Core Layer
    • Virtual LANs
      • VLANs on Access Points
    • Spanning Tree Protocol
    • IP Routing Overview
  • Introduction to Network Security
    • Type of Attacks
    • Attacks Phases
      • Infiltration Phase
      • Propagation Phase
      • Aggregation and Exfiltration Phase
    • Defenses
    • Security Metrics
  • Network Access Control
    • AAA Architecture
      • TACACS+
      • RADIUS
      • DIAMETER
    • IEEE 802.11 services
    • Joining a BSS
      • WLAN Frames
      • Joining BSS with AP
    • WPA and 802.11i (WPA2)
  • Network Flow Control
    • Network Security Systems
    • Firewalls
    • High-Availability
    • Load Balancing Firewall Load
    • Best Practices and Recommendations
    • IP Spoofing
    • Half-Open TCP Connection Problem
    • DDoS Mitigation at Source
    • Cisco’s Access Control Lists (ACL)
    • Linux IPTables
    • Control By Analysis of Higher Layers
  • Secure Communications
    • Public Key Infrastructure (PKI)
    • X.509 Certificate Contents
    • Traffic Tunnel Concept
      • Next Hop Resolution Protocol (NHRP)
      • Hub-Spoke vs. Spoke-Spoke
    • IPSec
    • Establishing SA and Cryptographic Keys
    • Virtual Private Networks (VPN)
    • Management of Asymmetric Keys
  • Remote Access
    • Remote Access
    • IPsec NAT Transversal
    • Integration with Flow Control
  • Intrusion Detection and Prevention
    • Intrusion Detection and Prevention
    • Host-Based vs. Network-Based
    • Signature vs. Anomaly Based
    • Network Deployment
  • Network Monitoring SIEM
    • Core and End-to-End Monitoring
    • Node Monitoring
    • End-User/Host/App Monitoring
    • Server/Service/Cloud Monitoring
    • Per-Service Detailed Monitoring
    • Data Sources
      • SNMP
      • NetFlow
    • Network Passive Probing Packet Capturing
    • Remote CLI Access
    • Log Files Access
      • Log Management Systems (LMS)
      • Security Information and Events Management (SIEM)
Powered by GitBook
On this page
  • SNMP
  • Flow exporting
  • Packet Captures / RAW statistics / DPI vs. SPI
  • Access Server/Device logs and/or CLI access.
  • Active measurements
  1. Network Monitoring SIEM

Data Sources

SNMP

  • Used to acquire knowledge about the current states of nodes/links/servers.

  • Local information. May be used to extrapolate to global information.

  • (Often) Requires the usage of vendor-specific MIBs.

Flow exporting

  • Used to characterize users/services in terms of the amount of traffic and traffic destinations.

  • Medium and large time-scale information.

  • Protocols: Cisco NetFlow, IPFIX – Standard, Juniper jFlow, and sFlow.

Packet Captures / RAW statistics / DPI vs. SPI

  • Used to characterize users/services in small time scales.

  • Requires distributed dedicated probes.

Access Server/Device logs and/or CLI access.

  • Used to acquire knowledge about past and current state.

Active measurements

  • Introduces entropy on the network and requires (for many measurements) precise clock synchronization.

  • E.g., one-way delay/jitter, round-trip delay/jitter.

PreviousPer-Service Detailed MonitoringNextSNMP

Last updated 1 year ago