2KKUU7ita

Figure 8-9:
OmniPeek
can help
uncover
someone
running an
illicit system,
such
as an FTP
server.
Chapter 8: Network Infrastructure
✓ When network traffic doesn’t look right in a network analyzer, it probably
isn’t. It’s better to be safe than sorry.
Run a baseline when your network is working normally. When you
have a baseline, you can see any obvious abnormalities when an attack
occurs.
One thing I like to check for is the top talkers (network hosts sending/receiving
the most traffic) on the network. If someone is doing something malicious
on the network, such as hosting an FTP server or running Internet file-sharing
software, using a network analyzer is often the only way you’ll find out about
it. A network analyzer is also a good tool for detecting systems infected with
malware, such as a virus or Trojan horse. Figure 8-9 shows what it looks like
to have a suspect protocol or application running on your network.
Looking at your network statistics, such as bytes per second, network utilization,
and inbound/outbound packet counts, is also a good way to determine
whether something fishy is going on. Figure 8-10 contains network statistics
as seen through the powerful CommView network analyzer.
TamoSoft — the maker of CommView — has another product called
NetResident (www.tamos.com/products/netresident) that can track
the usage of well-known protocols, such as HTTP, e-mail, FTP, and VoIP. As
shown in Figure 8-11, you can use NetResident to monitor web sessions and
play them back.
143