Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University

Digital Library

Javascript is currently disabled for your browser. For an optimal search experience, please enable javascript.

Advanced Search

Basic Search

Content Type

Topics

Publication Date

Technical Report

Network Profiling Using Flow

  • Abstract

    This report provides a step-by-step guide for profiling—discovering public-facing assets on a network—using network flow (netflow) data. Netflow data can be used for forensic purposes, for finding malicious activity, and for determining appropriate prioritization settings. The goal of this report is to create a profile to see a potential attacker’s view of an external network. Readers will learn how to choose a data set, find the top assets and services with the most traffic on the network, and profile several services. A case study provides an example of the profiling process. The underlying concepts of using netflow data are presented so that readers can apply the approach to other cases. A reader using this report to profile a network can expect to end with a list of public-facing assets and the ports on which each is communicating and may also learn other pertinent information, such as external IP addresses, to which the asset is connecting. This report also provides ideas for using, maintaining, and reporting on findings. The appendices include an example profile and scripts for running the commands in the report. The scripts are a summary only and cannot replace reading and understanding this report.

    Listen to the podcast from CERT's Podcast Series about this report.

  • Download

Cite This Report

SEI

Whisnant, Austin; & Faber, Sid. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Software Engineering Institute, Carnegie Mellon University, 2012. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=28115

IEEE

Whisnant. Austin, and Faber. Sid, "Network Profiling Using Flow," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2012-TR-006, 2012. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=28115

APA

Whisnant, Austin., & Faber, Sid. (2012). Network Profiling Using Flow (CMU/SEI-2012-TR-006). Retrieved December 20, 2014, from the Software Engineering Institute, Carnegie Mellon University website: http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=28115

CHI

Austin Whisnant, & Sid Faber. Network Profiling Using Flow (CMU/SEI-2012-TR-006). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2012. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=28115

MLA

Whisnant, Austin., & Faber, Sid. 2012. Network Profiling Using Flow (Technical Report CMU/SEI-2012-TR-006). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=28115