I recently took a CEH class and they mentioned checking for internal IP's probing to External unknown IP's to determine an attack. What would be the best way to gather and analyze these types of issues? Especially when you have a large network how do you keep track of this?


I think the best way is to use NetFlow analysis for large scale monitoring. If you have a Cisco router they have NetFlow collection built in and you can combine it with the open source tool suite SiLK for analysis https://forensics.cert.org/

NetFlow was initially developed by Cisco for billing purposes and collects none of the payload, only summary information such as:

  • Source IP
  • Dest IP
  • Source Port
  • Dest Port
  • Packets
  • Bytes
  • Start time
  • End Time
  • Flags
  • etc...

With this you can quickly analyze large amounts of data, I have one installation of SiLK using the open source NetFlow replacement IPFix from the IETF that gets 150,000 events per second.

There is a free handbook to get you started: https://tools.netsa.cert.org/silk/analysis-handbook.pdf

This would do exactly what you want and provide long term security benefits such as trending and anomaly detection.

Another option if you want to do this just one time, configure a span port on the egress point and collect data using tcpdump for a short bit. Just be sure to delete the PCAP when you are done as it may contain PII.


"Probing" is the keyword here.

If your users are allowed to surf the web, then all traffic over UDP 53, TCP 80/443 can probably be dismissed as a "deep dive analytics" problem (Netflow analytics and automatic anomaly detection can help here if the data set is massive).

Your known systems (with known IPs) might legitimately connect to other services on known IPs. Those can be whitelisted.

What you have left are the interesting bits (unexpected, non-web traffic). And it doesn't matter how large your network is, everything that is left requires investigation (and there is usually not a lot of it). If after investigation, you find legitimate traffic then you can whitelist that and continue the cycle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.