trabajo en clases

1. Date 2014/10/31
Type monthly
Device
Organization Fundación Charles Darwin
Country EC
City Quito
Serial A1203907986D482
License ID 279385
Hostname shield.fcdarwin.org.ec
Firmware Version 9.205-12
Uptime 1 days 10 hours 35 minutes
Summary
Network Usage Webadmin Logins
Traffic Processed 269.8 GB Successful 71
Connections handled 16 214 028 Failed 8
Network Protection Console Logins
Packets blocked by Firewall 7 507 278 Successful 0
Packets blocked by IPS 214 Failed 8
Web Filtering Up2Date
Total Website Requests 3152 Requests Successful 1
URLs blocked 266 Requests failed 0
HTTP/S viruses blocked 0 Firmware updates installed 0
HTTP/S malware blocked 0 Pattern updates installed 6
Mail Filtering System
Mails processed 0 System restarts 7
Spam Mails blocked 0 Uplink fail-overs 0
Virus Mails blocked 0 HA/Cluster failovers 0
VPN
VPN connections 0
VPN traffic not accounted

2. Resource Usage

3. Network Usage
TOP10 Clients
Total Packets: 519 922 912
Total Traffic: 281.3 GB
IP Hostname Packets Traffic %
lan 192.168.22.221 Javier Cotin Macbook 91 756 220 59.5 GB 21.16
lan 192.168.1.197 Luis Fernandez PC 26 799 389 17.0 GB 6.05
lan 192.168.1.19 IT-01 21 380 268 16.1 GB 5.73
lan 192.168.22.34 Gabriela Samaniego Toshiba 21 792 067 15.9 GB 5.65
lan 192.168.1.175 Router Sistemas Pruebas 22 521 131 10.6 GB 3.78
lan 192.168.22.150 yukako 19 604 622 9.2 GB 3.29
lan 192.168.1.210 Johanna XPS Laptop 10 611 710 7.5 GB 2.66
lan 192.168.1.3 Patricia Jaramillo Asus 8 529 845 6.6 GB 2.36
lan 192.168.1.186 Laptop-IT 10 842 295 6.1 GB 2.18
lan 192.168.1.205 Jesus Jimenez 1 9 293 449 6.1 GB 2.17
TOP10 Servers
Total Packets: 519 922 954
Total Traffic: 281.3 GB
IP Hostname Packets Traffic %
co 190.103.114.3 1_NewAccess [Mail] (Address) 28 994 143 12.4 GB 4.40
us 23.201.103.144 a23-201-103-144.deploy.static.akamaitechnologies.com 9 290 049 7.4 GB 2.64
ve 200.16.71.65 200.16.71.65 8 397 610 7.2 GB 2.56
us 50.16.209.69 ec2-50-16-209-69.compute-1.amazonaws.com 10 467 556 7.0 GB 2.50
de 85.13.151.88 dd34122.kasserver.com 4 682 086 4.1 GB 1.46
es 91.192.110.214 214-110.furanet.com 4 577 536 4.1 GB 1.44
us 17.253.6.232 usmia1-vip-lx-002.aaplimg.com 5 307 555 3.6 GB 1.28
co 200.35.32.3 200.35.32.3 3 929 597 3.5 GB 1.24
us 23.74.2.81 a23-74-2-81.deploy.static.akamaitechnologies.com 3 727 037 3.3 GB 1.16
us 204.236.220.75 ec2-204-236-220-75.compute-1.amazonaws.com 4 129 203 2.9 GB 1.02
TOP10 Services
Total Packets: 519 922 645
Total Traffic: 281.3 GB
Service Name Protocol Service Port Packets Traffic %
HTTPS TCP 443 252 179 216 129.3 GB 45.97
HTTP TCP 80 180 968 391 119.4 GB 42.47
SMTP TCP 25 15 632 472 7.2 GB 2.56
IMAPS TCP 993 12 619 790 6.4 GB 2.28
DOMAIN UDP 53 21 518 233 2.6 GB 0.94
SSH TCP 22 6 008 956 2.5 GB 0.90
53195 UDP 53195 2 342 295 1.5 GB 0.55
50043 TCP 50043 1 658 033 1.5 GB 0.52
44843 UDP 44843 1 896 408 1.3 GB 0.45
POP3S TCP 995 1 681 285 1.1 GB 0.39

4. TOP10 Applications
Total Packets: 519 922 820
Total Traffic: 281.3 GB
Application Packets Traffic %
Unclassified 367 237 351 200.1 GB 71.14
HTTP 22 799 805 16.0 GB 5.68
Netflix Site 12 890 698 11.0 GB 3.91
SSL 9 318 116 5.6 GB 1.98
Google 11 208 209 5.2 GB 1.86
Skype 21 451 164 4.4 GB 1.56
FTP 4 744 739 4.1 GB 1.47
Akamai 4 616 278 3.1 GB 1.11
Dropbox 3 494 623 2.4 GB 0.84
gmail 3 803 462 1.8 GB 0.65
TOP10 Application Categories
Total Packets: 519 922 859
Total Traffic: 281.3 GB
Application Category Packets Traffic %
Unclassified 367 237 399 200.1 GB 71.14
Web Services 68 711 600 41.7 GB 14.84
Streaming Media 16 575 918 13.5 GB 4.80
File Transfer 20 328 932 13.0 GB 4.64
Messaging 23 479 750 5.1 GB 1.83
Networking 13 054 018 3.3 GB 1.17
Mail 4 899 329 2.4 GB 0.85
Social Networking 4 824 340 1.9 GB 0.69
Remote Access 733 706 93.3 MB 0.03
Games 40 643 17.2 MB 0.01

6. Network Protection
Packet Filter / Firewall
TOP10 dropped source hosts
Total dropped packets: 7 507 278
Source IP Hostname Packets %
lan 192.168.1.175 Router Sistemas Pruebas 1 970 493 26.25
lan 192.168.22.189 iphone yukako 954 940 12.72
lan 192.168.22.185 Jose Feijoo Personal 450 898 6.01
lan 192.168.1.250 lapto personal pablo MAcbook 317 490 4.23
lan 192.168.22.221 Javier Cotin Macbook 264 654 3.53
lan 192.168.22.76 Amanda Herrick 176 732 2.35
lan 192.168.22.8 Andrew Laptop 172 190 2.29
lan 192.168.1.9 Lorenz_EquipoPErsonalW 164 612 2.19
lan 192.168.1.186 Laptop-IT 157 658 2.10
lan 192.168.22.153 iphone johanna carrion 110 763 1.48
TOP10 dropped destination hosts
Total dropped packets: 7 507 278
Destination IP Hostname Packets %
us 17.173.254.222 17.173.254.222 887 299 11.82
us 17.154.239.222 17.154.239.222 500 999 6.67
us 17.173.255.222 17.173.255.222 493 033 6.57
us 17.173.254.223 17.173.254.223 448 568 5.98
co 190.103.114.2 1_NewAccess (Address) 325 045 4.33
us 17.154.239.223 17.154.239.223 249 765 3.33
us 17.173.255.223 17.173.255.223 215 154 2.87
lan 224.0.0.1 all-systems.mcast.net 188 290 2.51
us 98.172.30.200 wsip-98-172-30-200.dc.dc.cox.net 114 302 1.52
lan 192.168.1.186 Laptop-IT 75 967 1.01
TOP10 dropped services
Total dropped packets: 7 507 278
Service Name Protocol Service Packets %
UDP 16384 953 094 12.70
UDP 16385 929 032 12.38
UDP 16386 914 116 12.18
TCP 5223 474 308 6.32
UDP 8612 303 418 4.04
HTTPS TCP 443 292 850 3.90
SNMP UDP 161 183 297 2.44
DDI-TCP-1 TCP 8888 151 725 2.02
NTP UDP 123 149 280 1.99
HTTP TCP 80 119 923 1.60

7. Intrusion Prevention System (IPS)
TOP10 Attacker
Total attack events: 214
Source IP Hostname Events %
lan 192.168.1.45 Internal mail server 37 17.29
de 129.70.208.22 unibi-smtp-b.hrz.uni-bielefeld.de 11 5.14
rs 82.117.208.243 static1-208-243.hosting.sbb.rs 9 4.21
us 198.23.213.90 198-23-213-90-host.colocrossing.com 8 3.74
us 74.217.148.111 74.217.148.111 7 3.27
ec 200.6.8.20 mail.mmrree.gob.ec 7 3.27
us 66.225.223.7 66.225.223.7 7 3.27
us 192.3.140.202 192-3-140-202-host.colocrossing.com 7 3.27
us 23.94.245.138 host.colocrossing.com 6 2.80
cn 110.190.111.61 110.190.111.61 5 2.34
TOP10 Attack Targets
Total attack events: 214
Destination IP Hostname Events %
lan 192.168.1.38 Server SIP 67 31.31
lan 192.168.1.1 0_Internal (Address) 37 17.29
lan 192.168.1.45 Internal mail server 34 15.89
lan 192.168.1.19 IT-01 16 7.48
lan 192.168.1.239 Samsung Luis Molina 10 4.67
lan 192.168.1.161 Metrerologia 6 2.80
lan 192.168.1.167 user(Pelayo Salinas ) 6 2.80
lan 192.168.1.175 Router Sistemas Pruebas 5 2.34
lan 192.168.1.190 192.168.1.190 4 1.87
lan 192.168.1.146 Natalia Tirado 4 1.87
TOP10 Attack Rules
Total attack events: 214
Rule ID Rule Name Group Events %
28556 PROTOCOL-DNS DNS query
amplification attempt
Server / Misc / DNS 54 25.23
28039 INDICATOR-COMPROMISE
Suspicious .pw dns query
Server / Misc / DNS 37 17.29
16482 BROWSER-IE Microsoft
Internet Explorer userdata
behavior memory corruption
attempt
Client / Browser 20 9.35
19099 BROWSER-WEBKIT Apple
Safari CSS font format
corruption attempt
Client / Browser 17 7.94
19321 BROWSER-FIREFOX Mozilla
Products nsCSSValue Array
Index Integer Overflow
Client / Browser 12 5.61
24155 FILE-PDF Adobe Acrobat
Reader free text annotation
invalid IT value denial of
service attempt
Client / Multimedia 11 5.14
19873 BROWSER-IE Microsoft
Internet Explorer CSS style
memory corruption attempt
Client / Browser 10 4.67

8. 20812 PROTOCOL-TELNET FreeBSD
telnetd enc_keyid overflow
attempt
Malware 9 4.21
22063 SERVER-WEBAPP PHP-CGI
remote file include attempt
Server / HTTP / PHP 9 4.21
25460 FILE-PDF Adobe Acrobat
Reader incomplete JP2K
image geometry - potentially
malicious
Client / Multimedia 7 3.27

9. Application Control
Application Filtering
TOP10 Applications
Total Packets: 300 881
Application Packets %
Dropbox 110 542 36.74
Windows Update 32 812 10.91
Kaspersky 32 430 10.78
Facebook 27 577 9.17
Twitter 22 710 7.55
Bittorrent 16 479 5.48
AppNexus 11 504 3.82
Avast.com 11 456 3.81
Google Drive 9 788 3.25
Apple 9 404 3.13
TOP10 Application Categories
Total packets: 300 881
Category Packets %
File Transfer 193 218 64.22
Social Networking 50 475 16.78
Web Services 40 310 13.40
Networking 9 404 3.13
Messaging 3 881 1.29
Streaming Media 3 593 1.19
TOP10 Blocked Sources
Total packets: 300 881
Client IP Client Hostname Packets %
192.168.1.167 user(Pelayo Salinas ) 54 495 18.11
192.168.22.190 Notebook Yukako 23 224 7.72
192.168.1.191 Piedad Lincango 22 694 7.54
192.168.22.185 Jose Feijoo Personal 19 737 6.56
192.168.22.108 Telefono Jesus 19 202 6.38
192.168.1.144 Tom Poulsom 15 494 5.15
192.168.22.89 Jeancarlos Bailon Compaq 12 702 4.22
192.168.1.124 Liza Diaz MAc 12 668 4.21
192.168.22.34 Gabriela Samaniego Toshiba 12 604 4.19
192.168.22.189 iphone yukako 9 154 3.04
TOP10 Blocked Destinations
Total packets: 300 881
Server IP Server Hostname Packets %
173.252.73.52 edge-star-shv-03-prn2.facebook.com 13 079 4.35
108.160.166.61 d-5b.sjc.dropbox.com 10 238 3.40
108.160.167.148 d-6b.v.dropbox.com 9 887 3.29
108.160.165.253 d-4a.v.dropbox.com 9 866 3.28
108.160.166.189 d-5a.sjc.dropbox.com 9 778 3.25
108.160.162.53 d-3a.v.dropbox.com 8 876 2.95
108.160.165.189 d-6a.sjc.dropbox.com 8 522 2.83
23.32.203.163 a23-32-203-163.deploy.static.akamaitechnologies.com 7 829 2.60
199.16.158.9 199.16.158.9 5 655 1.88
199.16.158.73 199.16.158.73 4 674 1.55
Sophos UTM Copyright 2002-2014 Sophos Ltd. All rights reserved.