Let me help you if i was your shoes I would go ask the network device administrators about the recent changes and demands review of access control and password management procedures. What symptoms you are entaling is quiet normal considering the pace and operations of an organization. You don't need forensics unless your boxes have been owned by a intelligent worm which is practically absent in current attack vectors against top line network devces unless we are talking about chinese made stuff zte or huwaei for that matter.

If you want quick win put a good ids box infront of core fw let it see all the traffic if it pick something relate this with your attack symptoms.

Let me help you if i was in your shoes I would go ask the network device administrators about the recent changes and demands review of access control and password management procedures. What symptoms you are entaling is quiet normal considering the pace and operations of an organization. You don't need forensics unless your boxes have been owned by a intelligent worm which is practically absent in current attack vectors against top line network devces unless we are talking about chinese made stuff zte or huwaei for that matter.

If you want quick win put a good ids box infront of core fw let it see all the traffic if it pick something relate this with your attack symptoms.

Let me help you if i was your shoes I would go ask the network device administrators about the changes and demands review of access control and password management procedures. What symptoms you are entaling is quiet normal considering the pace and operations of an organization. You don't need forensics unlessyour boxes have been owned by self learning bot which is practically absent in current attack vectors against top line network devices unless we are talking about chinese made sruff zte or huwaei for that matter.

Let me help you if i was your shoes I would go ask the network device administrators about the recent changes and demands review of access control and password management procedures. What symptoms you are entaling is quiet normal considering the pace and operations of an organization. You don't need forensics unless your boxes have been owned by a intelligent worm which is practically absent in current attack vectors against top line network devces unless we are talking about chinese made stuff zte or huwaei for that matter.

If you want quick win put a good ids box infront of core fw let it see all the traffic if it pick something relate this with your attack symptoms.