This report provides a step-by-step guide for profiling-discovering public-facing assets on a network-using network flow (netflow) data. Netflow data can be used for forensic purposes, for finding malicious activity, and for determining appropriate prioritization settings. The goal of this report is to create a profile to see a potential attacker's view of an external network.
Readers will learn how to choose a data set, find the top assets and services with the most traffic on the network, and profile several services. A case study provides an example of the profiling process. The underlying concepts of using netflow data are presented so that readers can apply the approach to other cases. A reader using this report to profile a network can expect to end with a list of public-facing assets and the ports on which each is communicating and may also learn other pertinent information, such as external IP addresses, to which the asset is connecting. This report also provides ideas for using, maintaining, and reporting on findings. The appendices include an example profile and scripts for running the commands in the report. The scripts are a summary only and cannot replace reading and understanding this report.
Listen to the podcast from CERT's Podcast Series about this report.
Cite This Report
Whisnant, Austin; & Faber, Sid. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Software Engineering Institute, Carnegie Mellon University, 2012. http://www.sei.cmu.edu/library/abstracts/reports/12tr006.cfm
A. Whisnant, and S. Faber, "Network Profiling Using Flow," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2012-TR-006, 2012.
Whisnant, A., & Faber, S. (2012). Network Profiling Using Flow (CMU/SEI-2012-TR-006). Retrieved June 19, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/12tr006.cfm
Whisnant, Austin, and Sid Faber. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2012. http://www.sei.cmu.edu/library/abstracts/reports/12tr006.cfm
Whisnant, A., & Faber, S. 2012. Network Profiling Using Flow (Technical Report CMU/SEI-2012-TR-006). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/12tr006.cfm