Savvius, Inc, profile picture
Uploaded bySavvius, Inc
6,237 views

Wired and Wireless Network Forensics

The document provides an overview of network forensics for both wired and wireless networks, defining it as the capture and analysis of network events to identify security incidents. It discusses the necessity of network forensics in managing increasing data volumes and complex threats, alongside practical applications and best practices. Additionally, the presentation highlights WildPackets' products and solutions designed to enhance network performance and forensic analysis capabilities.

Technology◦
Related topics:
Cyber-Security•

Embed presentation

Downloaded 273 times
Network Forensics for Wired and Wireless Networks Jay Botelho Director of Product Management WildPackets jbotelho@wildpackets.com Follow me @jaybotelho Show us your tweets! Use today’s webinar hashtag: #wp_networkforensics with any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
Administration • All callers are on mute ‒ If you have problems, please let us know via the Chat window • There will be Q&A ‒ Feel free to type a question at any time • Slides and recording will be available ‒ Notification within 48 hours via a follow-up email #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 2
Agenda • • • • • • • • What Is Network Forensics? Myths/Realities in Network Forensics Configuring Your Network for Forensics Wired vs. Wireless Network Forensics Use Cases Performing Forensic Analysis WildPackets Corporate Overview WildPackets Product Line Overview #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 3
What Is Network Forensics? © WildPackets, Inc. www.wildpackets.com 4
What is Network Forensics ? • Marcus Ranum is credited with defining Network Forensics as “the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents.” (wikipedia) • It’s not like TV – employ forensics before the “crime” - network traffic is transmitted and then lost, leaving no clues behind • Other names: packet mining, packet forensics, digital forensics #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
What Purpose Does It Serve ? • Allows us to find the details of network events after they have happened • Eliminates the need to reproduce network problems • Distill data to manageable levels by employing filters and analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Network vs. Security Forensics • Network forensics is a superset of security forensics • Forensics is not just DPI (Deep Packet Inspection) • Requires the lossless capture, storage, and analysis of extremely large data volumes • Network forensics: enterprise vs. lawful intercept ‒ Concerned with the process of reconstructing a network event • Network or infrastructure outage • Intrusion such as a “hack” or other penetration ‒ Provides a recording of the actual incident • Based on live IP packet data captures ‒ A new way of looking at trace file analysis ‒ Continues from where traditional network troubleshooting ends #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Network Forensics Drivers • Faster networks/greater data volumes ‒ 10/40G adoption grew 62% in 2012 ‒ 75% of the investments in networking are for 10G1 • Richer data • Subtler and more malicious security threats ‒ ‒ ‒ ‒ Zero-day attacks APTs (Advanced Persistent Threats) 75% of data breaches financially motivated 66% of breaches took months or longer to discover2 • Sampled data and high-level stats ‒ Flow-based network monitoring vs. detailed DPI analysis 1 http://www.infonetics.com/pr/2013/2H12-Networking-Ports-Market-Highlights.asp 2 http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2013_en_xg.pdf #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 8
Why Forensics? • Validate what your logs are telling you • Generate alarms/alerts on data you’ll never find in logs • Invest time analyzing, not reproducing • Immediately begin investigating the issue – you have a recording of the incident! • Isolate key data – from multi-TB archives - rapidly and intuitively • Understand the depth of penetration for any incident #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Myths/Realities in Network Forensics © WildPackets, Inc. www.wildpackets.com 10
Network Forensics 85% The number of respondents that feel network forensics is a necessity at 10G 31% The number who are using network forensics at 10G The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 11
Network Forensics Usage 12% For security purposes 28% For monitoring intermittent network issues For monitoring intermittent application issues For 24/7 transaction analysis 24% 36% The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 12
Challenges with Network Forensics The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 13
10G – Driving Network Forensics Usage  100 Participants  Company size:  43% - Large organizations  26% - Medium  31% - Small  Functional Breakdown  84% - Network Engineer  15% - IT Director  1% - Executive The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 14
10G – Driving Network Forensics Usage The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 15
The Implications of Doing Nothing  64% of organizations reported that managing network performance has become more complex over last 12 months  Organizations are losing on average $72,000 per minute of unplanned network downtime  48% of organizations reported that, on average, they spend more than 60 minutes on repairing performance issues - per incident #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Configuring Your Network for Forensics © WildPackets, Inc. www.wildpackets.com 17
Requirements for a Network Forensics Solution • Capturing and recording data ‒ ‒ ‒ ‒ 10/40G network support No dropped packets – 100% fidelity Continuously available Always test in your environment • Discovering data ‒ Timely results delivery ‒ Filtering for IP addresses, applications, etc. • Analyzing data ‒ Automated analysis – Expert events ‒ Simple, intuitive workflow ‒ Data visualization from multiple perspectives #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 18
10G Network Analysis Workflow Deploy 24x7 Monitoring Identify Key Analysis Pts NO Alarms/ Alerts Problem? YES Rewind Data #wp_forensics Analyze Network Forensics for Wired and Wireless Networks Tune if Necessary © WildPackets, Inc.
A Solution for Every Network #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 20
Data Capture from High-Speed Links #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Forensic Analysis – Capturing An Attack 2. Data Recorder records and aggregates data throughout attack IDS/IPS System 3. Event logged, attack partially tracked by IDS Servers 1. Attack bypasses firewall #wp_forensics 4. Post event analysis reveals attacker, method, damage! Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
10G Network Data Storage • 1Gbps steady-state traffic assuming no storage overhead: 7.68 GB/min 460 GB/hr 11 TB/day 2.9 days in a 32TB appliance • 10Gbps: 76.8GB/min 4.6 TB/hr 110 TB/day 28 hours in a 128TB appliance #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Wired vs. Wireless Network Forensics © WildPackets, Inc. www.wildpackets.com 24
802.11ac – Breaking the Gigabit Barrier Gratuitous clipart - Please ignore 11 Mbps 1-2 Mbps 802.11b <1 Mbps 802.11 1997 550% 100% Proprietary 1989 #wp_forensics 1991 1999 433/866/1300+ Mbps 802.11ac 288% (vs. 450) (to 6.93 Gbps) 300/450/600 Mbps 802.11n 54 Mbps 833% 802.11g/a 490% 2003 2009 2013 Source: Farpoint Group Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
#wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 26
Additional Drivers for Wireless Forensics • BYOD ‒ No configuration control ‒ Limited or no access to the end-user device ‒ Problems reported “after the fact” • Point-of-Presence required ‒ Wireless data must be captured within a few hundred feet of the device ‒ Vastly more collection points than for wired forensics • Data volumes that rival wired data ‒ 1.3Gbps will be common with 802.11ac ‒ Mobile devices outnumbering wired devices #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 27
Wireless Forensics Solution • As wireless approaches wired speeds, it’s time to start relying on the wire • Distributed analysis using deployed assets – APs – is the only effective solution as wireless speeds grow • 24/7 capture/analysis ensures problems aren’t missed • Recording enables wireless forensic analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 28
Wireless Forensics Benefits • Reduce MTTR • Prioritize analysis tasks ‒ No need to reproduce a problem ‒ No need to wait for it to happen again • Increase WLAN service uptime ‒ WLANs are now missioncritical ‒ Mobility implies you won’t be near the problem ‒ Deal with emergencies immediately ‒ Handle routine investigations as time permits ‒ Save data for long-term analysis • Reduce reaction time ‒ Data are always available for analysis • Reduce analysis costs ‒ A single solution for wireless and wired analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 29
Use Cases © WildPackets, Inc. www.wildpackets.com
Use Cases for Network Forensics • Finding proof of a security attack • Troubleshooting intermittent performance issues • Monitoring user activity for compliance with IT and HR policies • Identifying the source of data leaks • Monitoring business transactions • Verifying VoIP and video over IP performance #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 31
Best Practices for Network Forensics Capturing Network Traffic 1. Capture traffic continuously 2. Deploy a solution that captures traffic reliably 3. Set up filters to catch anomalies Storing Traffic 4. Allocate sufficient storage for the volume of data being collected 5. Adjust file sizes for the desired performance optimization #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 32
Best Practices for Network Forensics (cont.) Analyzing Traffic 6. Select a network forensics solution that supports filters and searches that are fast, flexible, and precise 7. Record baseline measurements of network performance 8. Use filters to zoom in on the problem at hand #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 33
Performing Forensic Analysis © WildPackets, Inc. www.wildpackets.com
WildPackets – The Network Forensics Myth Buster Myth Busted Can’t analyze at 10G line rate Dropped packets Captured data is not reliable Inability to collect packets at all network locations Inadequate real-time stats Real-time analysis no longer an option Limited visibility into VoIP Inability to analyze/search recorded traffic No end-to-end visibility into application transactions Limitations in security monitoring #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 35
Q&A Show us your tweets! Use today’s webinar hashtag: Follow us on SlideShare! #wp_forensics Check out today’s slides on SlideShare www.slideshare.net/wildpackets with any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
WildPackets Corporate Overview Optimizing Network and Application Performance © WildPackets, Inc. www.wildpackets.com
Corporate Background • Experts in network monitoring, analysis, and troubleshooting ‒ Founded: 1990 / Headquarters: Walnut Creek, CA ‒ Offices throughout the US, EMEA, and APAC • Customers spanning leading edge organizations ‒ Mid-market and enterprise lines of business ‒ Financial, manufacturing, ISPs, major federal agencies, state and local governments, universities ‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000 • Award-winning solutions that improve network performance ‒ Internet Telephony, Network Magazine, Network Computing awards ‒ United States Patent 5,787,253 issued July 28, 1998 • “Apparatus and Method of Analyzing Internet Activity” #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Why Our Customers Need Us • VoIP, video, cloud, virtualization, and key business applications are saturating critical network services • Evolving network technologies create discontinuities ‒ 1 Gig  10 Gig  40 Gig  100 Gig networks ‒ Wireless, BYOD initiatives • Users and business can not tolerate network problems for mission critical services Increasing demand for better real-time network visibility, network analytics, network forensics, and DPI #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
How We Create Value We provide innovative, industry-leading, real-time network performance management solutions ‒ Easy-to-use, easy-to-learn user interface ‒ Uniquely extensible solutions ‒ Wireless network leadership ‒ Detailed analytics related to network applications ‒ Fastest network traffic capture appliance in its class ‒ Technical superiority at competitive price point WildPackets has continually advanced its solution to meet the needs of its customers #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Unprecedented Network Visibility NETWORK HEALTH GLOBAL WatchPoint can manage and report on key device performance and availability across the entire network, from anywhere on the network. UNDERSTAND END-USER PERFORMANCE DISTRIBUTED Omnipliance network analysis and recorder appliances monitor and analyze performance across critical network segments, virtual environments, and remote sites. PINPOINT NETWORK ISSUES ANYWHERE PORTABLE Omnipliance Portable can rapidly identify and troubleshoot issues before they become major problems—wired or wireless—down the hall or across the globe. ROOT-CAUSE ANALYSIS DPI #wp_forensics OmniPeek network analyzer performs deep packet inspection and can reconstruct all network activity, including e-mail and IM, as well as analyze VoIP and video traffic quality. Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
A History of Innovation 2001 2005 2009 2011 • First 802.11 wireless analyzer • First network analyzer with automated expert analysis Combined distributed network and VoIP network analysis Innovative dashboard with drill-down for VoIP and video • Total visibility with zero packet loss • First wireless network analyzer to support capture and analysis of 802.11n 3-stream wireless 2008 2010 2012 2013 Distributed real-time Enterprise-wide troubleshooting Monitoring and Reporting First to achieve 11 Gbps sustained capture-to-disk • Capture, record, and analyze from 40G network segments • First wireless network analyzer to support 801.11ac, k, r, u, v, w Industry leading network analysis and recorder appliances 2003 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Product Line Overview © WildPackets, Inc. www.wildpackets.com
Omni Distributed Analysis Platform OmniPeek Enterprise Packet Capture, Decode and Analysis • Ethernet,1/10 Gigabit, 802.11, and voice and video over IP • Portable capture and OmniEngine console • Aggregate analysis data across multiple capture points Omnipliance Network Analysis and Recorder Appliances • High-performance packet capture and real-time analysis • Stream-to-disk for forensics analysis • Integrated OmniAdapter network analysis cards up to 40G WatchPoint Centralized Enterprise Network Monitoring Appliance • Aggregation and graphical display of network data • WildPackets OmniEngines • NetFlow and sFlow #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Omni Distributed Analysis Platform Software and Turnkey Solutions • Enterprise monitoring and reporting ‒ WatchPoint Server ‒ OmniFlow, NetFlow, and sFlow Collectors • Network Analysis and Recorder Appliances ‒ Omnipliance CX, MX, TL ‒ Optional OmniStorage ‒ OmniAdapter analysis cards • Distributed analysis software ‒ OmniPeek – Enterprise, Professional, Basic, Connect ‒ OmniPeek Remote Assistant ‒ OmniEngine Enterprise • Portable solutions ‒ OmniPeek network analyzer ‒ Omnipliance Portable #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
OmniPeek Network Analyzer • Distributed analysis manager – Connect to and configure distributed OmniEngines and Omnipliances, • Comprehensive dashboards present network traffic in real-time – Vital statistics and graphs display trends on network and application performance – Visual peer-map shows conversations and protocols – Intuitive drill-down for root-cause analysis of performance bottlenecks • Visual Expert diagnosis speeds problem resolution – Packet and payload visualizers provide business-centric views • Automated analytics and problem detection 24/7 – Easily create filters, triggers, scripting, advanced alarms, and alerts #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
OmniPeek Remote Assistant Distributed, End-user Packet Capture Made Simple • Simple to deploy, simple to use ‒ Remote push, download from server, or even email ‒ Simple user interface - eliminates confusion for end user ‒ Full fidelity capture - see exactly what the PC sees ‒ Wired or wireless Trouble call from remote site network response is slow. • Encrypted file ‒ Only the analyst can open it ‒ Different encryption keys for different locations or customers User downloads and installs OmniPeek Remote. Encrypted capture data sent back for analysis. • Detailed client-side/end-user experience analysis • Perfect for Tech Support or IT Desktop support #wp_forensics Network Forensics for Wired and Wireless Networks Network analyst uses OmniPeek Enterprise to quickly troubleshoot problem without leaving the office. © WildPackets, Inc.
OmniWiFi USB WLAN Capture Adapter • A single device for all WLAN packet capture needs • Driver included with Omni v7.9 CDs • Tested and supported with OmniPeek and OmniEngine • Product features: • • • • • • USB device with extension cable Dual band operation – 2.4GHz and 5GHz Supports all standard international 802.11 channels (a/b/g/n) Supports 802.11n - 3 transmit/receive streams (450Mbps) Supports 802.11n 20MHz and 40MHz channel operation Supports multi-channel aggregation and roaming • Technical Details: ‒ Size (LWH): 6 inches, 1.5 inches, 5.5 inches ‒ Weight: 5.6 ounces NOTE: • Capture ONLY – no network services • Does not capture 802.11ac • Available via Amazon - $99/each #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
New Network Analysis and Recorder Appliances Powerful Precise Affordable The new family of WildPackets Network Analysis and Recorder appliances gives IT organizations powerful and precise analysis of high-speed networks in an affordable solution with half the hardware footprint of rival offerings. #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Powerful ‒ Fastest network recorder in its class! Captures traffic up to 20Gbps of realworld traffic (all size packet distribution) ‒ Scales up to 128 TB of storage ‒ Provides simultaneous real-time analysis and a comprehensive Forensic Search that rapidly searches through terabytes of captured traffic for the details relevant to an investigation Precise ‒ Captures complete network traffic, so you can analyze everything, not just samples or high-level statistics ‒ Doesn’t drop packets or sacrifice accuracy for speed ‒ Supports rich, detailed analysis, including VoIP and video-over-IP traffic Affordable ‒ Delivers outstanding price/performance (lower price; half the rack space) ‒ Allows mix of 1G/10G/40G interfaces without buying extra appliances ‒ Solutions start at $16,995 Your network is bigger and faster. Now your analysis solution is, too. #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Omnipliance TL Industry Leading Network Analysis and Recorder Appliance • Sets a new standard in capture-to-disk speeds ‒ 20Gbps sustained capture to disk rate with zero packet drop • Best price/performance Network Analysis Appliance in the market ‒ 20Gbps with only one Omnipliance TL + OmniStorage ‒ Consuming less rack space, less cooling, less electrical power • Most flexible network interface offering ‒ 1G/10G/40G interfaces supported in a single unit eliminates additional unit requirement • Most accurate real-time analytics ‒ Packet-based processing and analysis vs. inaccurate samplebased calculation #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
WildPackets Network Analysis Recorder Appliances Price/Performance Solutions for Every Application Portable Omnipliance CX Omnipliance MX Omnipliance TL Ruggedized Troubleshooting Less Demanding Networks Remote Offices Datacenter Workhorse Easily Expandable Enterprise, HighlyUtilized Networks Aluminum chassis / 17” LCD 1U rack mountable chassis 3U rack mountable chassis 3U rack mountable chassis 24GB RAM 16GB RAM 32GB RAM 64GB RAM 2 PCI-E Slots 2 PCI-E Slots 4 PCI-E Slots 4 PCI-E Slots 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 6TB Storage 4/8/16TB Storage 16/32TB Storage 32/48/64TB Storage Optional OmniStorage: 32/48/64TB Up to 128TB total Storage OmniAdapter 1G and 10G OmniAdapter 1G/10G MX OmniAdapter 1G/10G MX OmniAdapter 1G/10G/40G 6.5Gbps CTD 3.8Gbps CTD 8.8Gbps CTD 20Gbps CTD with OmniStorage #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
WatchPoint Centralized Monitoring for Distributed Enterprise Networks • High-level, aggregated view of all network segments – Monitor per campus, per region, per country • Wide range of network data – NetFlow, sFlow, OmniFlow • • • #wp_forensics Network Forensics for Wired and Wireless Networks Web-based, customizable network dashboards Flexible detailed reports Direct link to detailed, packet-based analysis © WildPackets, Inc.
Comprehensive Support and Services Standard Support     Premier Support Maintenance and upgrades Telephone and email contacts Knowledgebase MyPeek Portal     24 x 7 x 365 Dedicated escalation manager 2 customer contacts per site Plug-in reconfiguration assistance WildPackets Training Academy  Public, web-based, and on-site classes  Complete curriculum: technology and product focused  Practical applications and labs covering network analysis, wireless, VoIP monitoring and advanced troubleshooting Consulting and Custom Development Services  Deployment, configuration, and assessment engagement  Systems integration and testing  Application integration, driver, decode, interface development #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
WildPackets Key Differentiators • Visual Expert intelligence with intuitive drill-down – Let computer do the hard work, and return results, real-time – Packet /payload visualization is faster than packet-per-packet diagnostics – Experts and analytics can be memorized and automated • Automated capture analytics – Filters, triggers, scripting, and advanced alarming system combine to provide automated network problem detection 24x7 • Multiple issue network forensics – Can be tracked by one or more people simultaneously – Real-time or post capture • User-extensible platform – Plug-in architecture and SDK • Aggregated network views and reporting – NetFlow, sFlow, and OmniFlow #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
24x7 Network Monitoring, Analysis, and Troubleshooting #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
Thank You! WildPackets, Inc. 1340 Treat Boulevard, Suite 500 Walnut Creek, CA 94597 (925) 937-3200 © WildPackets, Inc. www.wildpackets.com

More Related Content

PPTX
Network forensics and investigating logs
byanilinvns
 
PPTX
Network Forensics Intro
byJake K.
 
PPTX
Mobile Forensics
byprimeteacher32
 
PDF
Incident response methodology
byPiyush Jain
 
DOCX
The CIA Triad - Assurance on Information Security
byBharath Rao
 
PDF
CS6004 Cyber Forensics
byKathirvel Ayyaswamy
 
PDF
Network Forensic
bySujeet Kumar
 
PDF
02 Types of Computer Forensics Technology - Notes
byKranthi
 
Network forensics and investigating logs
byanilinvns
 
Network Forensics Intro
byJake K.
 
Mobile Forensics
byprimeteacher32
 
Incident response methodology
byPiyush Jain
 
The CIA Triad - Assurance on Information Security
byBharath Rao
 
CS6004 Cyber Forensics
byKathirvel Ayyaswamy
 
Network Forensic
bySujeet Kumar
 
02 Types of Computer Forensics Technology - Notes
byKranthi
 

What's hot

PDF
Network Security Fundamentals
byRahmat Suhatman
 
PPTX
Digital forensics
byvishnuv43
 
PPTX
Network forensic
byManjushree Mashal
 
PPTX
Intrusion prevention system(ips)
byPapun Papun
 
PPTX
Network Forensics
byprimeteacher32
 
PPT
Network forensics1
bySantosh Khadsare
 
PDF
Network forensics
byArthyR3
 
PPTX
Data Acquisition
byprimeteacher32
 
PPT
Mobile forensics
bynoorashams
 
PPT
Intrusion detection system ppt
bySheetal Verma
 
PDF
Digital forensic principles and procedure
bynewbie2019
 
PPT
Digital Forensic
byCleverence Kombe
 
PPT
Digital Forensics
byNicholas Davis
 
PPTX
Mobile Phone Seizure Guide by Raghu Khimani
byDr Raghu Khimani
 
PPSX
Cloud Forensics
bysdavis532
 
PDF
Cloud-forensics
byanupriti
 
PPTX
Processing Crimes and Incident Scenes
byprimeteacher32
 
PPTX
Mobile Forensics
byabdullah roomi
 
PPT
data hiding techniques.ppt
byMuzamil Amin
 
PPT
Internet Traffic Monitoring and Analysis
byInformation Technology
 
Network Security Fundamentals
byRahmat Suhatman
 
Digital forensics
byvishnuv43
 
Network forensic
byManjushree Mashal
 
Intrusion prevention system(ips)
byPapun Papun
 
Network Forensics
byprimeteacher32
 
Network forensics1
bySantosh Khadsare
 
Network forensics
byArthyR3
 
Data Acquisition
byprimeteacher32
 
Mobile forensics
bynoorashams
 
Intrusion detection system ppt
bySheetal Verma
 
Digital forensic principles and procedure
bynewbie2019
 
Digital Forensic
byCleverence Kombe
 
Digital Forensics
byNicholas Davis
 
Mobile Phone Seizure Guide by Raghu Khimani
byDr Raghu Khimani
 
Cloud Forensics
bysdavis532
 
Cloud-forensics
byanupriti
 
Processing Crimes and Incident Scenes
byprimeteacher32
 
Mobile Forensics
byabdullah roomi
 
data hiding techniques.ppt
byMuzamil Amin
 
Internet Traffic Monitoring and Analysis
byInformation Technology
 

Similar to Wired and Wireless Network Forensics

PPTX
You Suspect a Security Breach. Network Forensic Analysis Gives You the Answers
bySavvius, Inc
 
PDF
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
bySavvius, Inc
 
PPTX
Security Attack Analysis for Finding and Stopping Network Attacks
bySavvius, Inc
 
PDF
Network Forensics - Your Only Choice at 10G
bySavvius, Inc
 
PDF
How can Savvius help your organization?
bySTelligence Company
 
PPTX
Network Forensics Backwards and Forwards
bySavvius, Inc
 
PDF
(130511) #fitalk network forensics and its role and scope
byINSIGHT FORENSIC
 
PDF
Omnipliance family - Powerful Precise Affordable
bySavvius, Inc
 
PDF
Network Forensics.pdf
byShivamSolanki53
 
PPTX
Crimeppt
byKalaiselvi k
 
PDF
Network Analysis Tips and Tricks with OmniPeek
bySavvius, Inc
 
PPTX
Forensic Analysis - Empower Tech Days 2013
byIslam Azeddine Mennouchi
 
PDF
Network Forensics and Practical Packet Analysis
byPriyanka Aash
 
PDF
The Changing Landscape in Network Performance Monitoring
bySavvius, Inc
 
PDF
Network forensics - Follow the Bad Rabbit down the wire
bycasheeew
 
PPTX
Open source network forensics and advanced pcap analysis
byGTKlondike
 
PDF
Evaluating Network Forensics Applying Advanced Tools
byIJAEMSJORNAL
 
PDF
IRJET - Digital Forensics Analysis for Network Related Data
byIRJET Journal
 
PPT
SoleraNetworks
byJoe Levy
 
PPTX
Gigabit WLANs Need Gigabit WLAN Analysis
bySavvius, Inc
 
You Suspect a Security Breach. Network Forensic Analysis Gives You the Answers
bySavvius, Inc
 
All Hope is Not Lost Network Forensics Exposes Today's Advanced Security Thr...
bySavvius, Inc
 
Security Attack Analysis for Finding and Stopping Network Attacks
bySavvius, Inc
 
Network Forensics - Your Only Choice at 10G
bySavvius, Inc
 
How can Savvius help your organization?
bySTelligence Company
 
Network Forensics Backwards and Forwards
bySavvius, Inc
 
(130511) #fitalk network forensics and its role and scope
byINSIGHT FORENSIC
 
Omnipliance family - Powerful Precise Affordable
bySavvius, Inc
 
Network Forensics.pdf
byShivamSolanki53
 
Crimeppt
byKalaiselvi k
 
Network Analysis Tips and Tricks with OmniPeek
bySavvius, Inc
 
Forensic Analysis - Empower Tech Days 2013
byIslam Azeddine Mennouchi
 
Network Forensics and Practical Packet Analysis
byPriyanka Aash
 
The Changing Landscape in Network Performance Monitoring
bySavvius, Inc
 
Network forensics - Follow the Bad Rabbit down the wire
bycasheeew
 
Open source network forensics and advanced pcap analysis
byGTKlondike
 
Evaluating Network Forensics Applying Advanced Tools
byIJAEMSJORNAL
 
IRJET - Digital Forensics Analysis for Network Related Data
byIRJET Journal
 
SoleraNetworks
byJoe Levy
 
Gigabit WLANs Need Gigabit WLAN Analysis
bySavvius, Inc
 

More from Savvius, Inc

PPTX
Introducing Savvius Vigil
bySavvius, Inc
 
PPTX
Long Term Reporting with Savvius and Splunk
bySavvius, Inc
 
PPTX
Network Analysis Tips & Tricks with Omnipeek
bySavvius, Inc
 
PPTX
Why Every Engineer Needs WLAN Packet Analysis
bySavvius, Inc
 
PDF
Bright talk voip vofi webinar jan2015-v2
bySavvius, Inc
 
PPTX
Are you ready for 802.11ac?
bySavvius, Inc
 
PDF
Are You Missing Something?
bySavvius, Inc
 
PDF
Visibility into 40G/100G Networks for Real-time and Post Capture Analysis and...
bySavvius, Inc
 
PPTX
Managing a Widely Distributed Network
bySavvius, Inc
 
PPTX
VoIP Monitoring and Analysis - Still Top of Mind in Network Performance Monit...
bySavvius, Inc
 
PPTX
WildPackets EMA Whitepaper Preview
bySavvius, Inc
 
PPTX
Network Network Visibility - The Key to Rapidly Troubleshooting Network Perfo...
bySavvius, Inc
 
PDF
Wireless Network Analysis 101 VoFi (Voice over Wi-Fi)
bySavvius, Inc
 
PDF
802.11ac: Technologies and Deployment Strategies with FarPoint Group
bySavvius, Inc
 
PDF
Capturing 802.11ac Data
bySavvius, Inc
 
PPTX
Real-Time Visibility into High Speed Networks
bySavvius, Inc
 
PDF
Bringing Big Data Analytics to Network Monitoring
bySavvius, Inc
 
PDF
The blind spot in virtual servers - seeing with network analysis
bySavvius, Inc
 
PDF
Introducing network analysis and data capture for 802.11ac
bySavvius, Inc
 
PDF
802.11ac - Wireless Gigabit Speeds Driving Changes in Wireless Analysis
bySavvius, Inc
 
Introducing Savvius Vigil
bySavvius, Inc
 
Long Term Reporting with Savvius and Splunk
bySavvius, Inc
 
Network Analysis Tips & Tricks with Omnipeek
bySavvius, Inc
 
Why Every Engineer Needs WLAN Packet Analysis
bySavvius, Inc
 
Bright talk voip vofi webinar jan2015-v2
bySavvius, Inc
 
Are you ready for 802.11ac?
bySavvius, Inc
 
Are You Missing Something?
bySavvius, Inc
 
Visibility into 40G/100G Networks for Real-time and Post Capture Analysis and...
bySavvius, Inc
 
Managing a Widely Distributed Network
bySavvius, Inc
 
VoIP Monitoring and Analysis - Still Top of Mind in Network Performance Monit...
bySavvius, Inc
 
WildPackets EMA Whitepaper Preview
bySavvius, Inc
 
Network Network Visibility - The Key to Rapidly Troubleshooting Network Perfo...
bySavvius, Inc
 
Wireless Network Analysis 101 VoFi (Voice over Wi-Fi)
bySavvius, Inc
 
802.11ac: Technologies and Deployment Strategies with FarPoint Group
bySavvius, Inc
 
Capturing 802.11ac Data
bySavvius, Inc
 
Real-Time Visibility into High Speed Networks
bySavvius, Inc
 
Bringing Big Data Analytics to Network Monitoring
bySavvius, Inc
 
The blind spot in virtual servers - seeing with network analysis
bySavvius, Inc
 
Introducing network analysis and data capture for 802.11ac
bySavvius, Inc
 
802.11ac - Wireless Gigabit Speeds Driving Changes in Wireless Analysis
bySavvius, Inc
 

Recently uploaded

PPTX
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
PPTX
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
PDF
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
PDF
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
PPTX
Software Analysis &Design ethiopia chap-2.pptx
byAbbas484771
 
PDF
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
PDF
API-First Architecture in Financial Systems
bycyy111112
 
PDF
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
PPTX
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
PPTX
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
PDF
Day 2 - Network Security ~ 2nd Sight Lab ~ Cloud Security Class ~ 2020
by2nd Sight Lab
 
PPTX
Protecting Data in an AI Driven World - Cybersecurity in 2026
byYasir Naveed Riaz
 
PDF
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
PDF
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
PDF
The year in review - MarvelClient in 2025
bypanagenda
 
PPTX
Kanban India 2025 | Daksh Gupta | Modeling the Models, Generative AI & Kanban
byLeanKanbanIndia
 
PDF
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
PPTX
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
PDF
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
PPTX
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 
Cybercrime in the Digital Age: Risks, Impact & Protection
byYasir Naveed Riaz
 
Cybersecurity Best Practices - Step by Step guidelines
byYasir Naveed Riaz
 
Unser Jahresrückblick – MarvelClient in 2025
bypanagenda
 
Six Shifts For 2026 (And The Next Six Years)
byDavid Armano
 
Software Analysis &Design ethiopia chap-2.pptx
byAbbas484771
 
Session 1 - Solving Semi-Structured Documents with Document Understanding
byDianaGray10
 
API-First Architecture in Financial Systems
bycyy111112
 
Eredità digitale sugli smartphone: cosa resta di noi nei dispositivi mobili
bySpeck&Tech
 
From Backup to Resilience: How MSPs Are Preparing for 2026
byMSP360
 
Building Cyber Resilience for 2026: Best Practices for a Secure, AI-Driven Bu...
byYasir Naveed Riaz
 
Day 2 - Network Security ~ 2nd Sight Lab ~ Cloud Security Class ~ 2020
by2nd Sight Lab
 
Protecting Data in an AI Driven World - Cybersecurity in 2026
byYasir Naveed Riaz
 
Making Sense of Raster: From Bit Depth to Better Workflows
bySafe Software
 
Day 5 - Red Team + Blue Team in the Cloud - 2nd Sight Lab Cloud Security Class
by2nd Sight Lab
 
The year in review - MarvelClient in 2025
bypanagenda
 
Kanban India 2025 | Daksh Gupta | Modeling the Models, Generative AI & Kanban
byLeanKanbanIndia
 
Vibe Coding vs. Spec-Driven Development [Free Meetup]
byHaim Michael
 
Unit-4-ARTIFICIAL NEURAL NETWORKS.pptx ANN ppt Artificial neural network
byssuserd4481a
 
Is It Possible to Have Wi-Fi Without an Internet Provider
bySidra Jefferi
 
AI in Cybersecurity: Digital Defense by Yasir Naveed Riaz
byYasir Naveed Riaz
 

Wired and Wireless Network Forensics

  • 1.
    Network Forensics for Wiredand Wireless Networks Jay Botelho Director of Product Management WildPackets jbotelho@wildpackets.com Follow me @jaybotelho Show us your tweets! Use today’s webinar hashtag: #wp_networkforensics with any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
  • 2.
    Administration • All callersare on mute ‒ If you have problems, please let us know via the Chat window • There will be Q&A ‒ Feel free to type a question at any time • Slides and recording will be available ‒ Notification within 48 hours via a follow-up email #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 2
  • 3.
    Agenda • • • • • • • • What Is NetworkForensics? Myths/Realities in Network Forensics Configuring Your Network for Forensics Wired vs. Wireless Network Forensics Use Cases Performing Forensic Analysis WildPackets Corporate Overview WildPackets Product Line Overview #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 3
  • 4.
    What Is NetworkForensics? © WildPackets, Inc. www.wildpackets.com 4
  • 5.
    What is NetworkForensics ? • Marcus Ranum is credited with defining Network Forensics as “the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents.” (wikipedia) • It’s not like TV – employ forensics before the “crime” - network traffic is transmitted and then lost, leaving no clues behind • Other names: packet mining, packet forensics, digital forensics #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 6.
    What Purpose DoesIt Serve ? • Allows us to find the details of network events after they have happened • Eliminates the need to reproduce network problems • Distill data to manageable levels by employing filters and analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 7.
    Network vs. SecurityForensics • Network forensics is a superset of security forensics • Forensics is not just DPI (Deep Packet Inspection) • Requires the lossless capture, storage, and analysis of extremely large data volumes • Network forensics: enterprise vs. lawful intercept ‒ Concerned with the process of reconstructing a network event • Network or infrastructure outage • Intrusion such as a “hack” or other penetration ‒ Provides a recording of the actual incident • Based on live IP packet data captures ‒ A new way of looking at trace file analysis ‒ Continues from where traditional network troubleshooting ends #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 8.
    Network Forensics Drivers •Faster networks/greater data volumes ‒ 10/40G adoption grew 62% in 2012 ‒ 75% of the investments in networking are for 10G1 • Richer data • Subtler and more malicious security threats ‒ ‒ ‒ ‒ Zero-day attacks APTs (Advanced Persistent Threats) 75% of data breaches financially motivated 66% of breaches took months or longer to discover2 • Sampled data and high-level stats ‒ Flow-based network monitoring vs. detailed DPI analysis 1 http://www.infonetics.com/pr/2013/2H12-Networking-Ports-Market-Highlights.asp 2 http://www.verizonenterprise.com/resources/reports/rp_data-breach-investigations-report-2013_en_xg.pdf #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 8
  • 9.
    Why Forensics? • Validatewhat your logs are telling you • Generate alarms/alerts on data you’ll never find in logs • Invest time analyzing, not reproducing • Immediately begin investigating the issue – you have a recording of the incident! • Isolate key data – from multi-TB archives - rapidly and intuitively • Understand the depth of penetration for any incident #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 10.
    Myths/Realities in Network Forensics ©WildPackets, Inc. www.wildpackets.com 10
  • 11.
    Network Forensics 85% The numberof respondents that feel network forensics is a necessity at 10G 31% The number who are using network forensics at 10G The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 11
  • 12.
    Network Forensics Usage 12% Forsecurity purposes 28% For monitoring intermittent network issues For monitoring intermittent application issues For 24/7 transaction analysis 24% 36% The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 12
  • 13.
    Challenges with NetworkForensics The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 13
  • 14.
    10G – DrivingNetwork Forensics Usage  100 Participants  Company size:  43% - Large organizations  26% - Medium  31% - Small  Functional Breakdown  84% - Network Engineer  15% - IT Director  1% - Executive The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 14
  • 15.
    10G – DrivingNetwork Forensics Usage The State of Faster Networks, WildPackets, Oct 2013 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 15
  • 16.
    The Implications ofDoing Nothing  64% of organizations reported that managing network performance has become more complex over last 12 months  Organizations are losing on average $72,000 per minute of unplanned network downtime  48% of organizations reported that, on average, they spend more than 60 minutes on repairing performance issues - per incident #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 17.
    Configuring Your Networkfor Forensics © WildPackets, Inc. www.wildpackets.com 17
  • 18.
    Requirements for aNetwork Forensics Solution • Capturing and recording data ‒ ‒ ‒ ‒ 10/40G network support No dropped packets – 100% fidelity Continuously available Always test in your environment • Discovering data ‒ Timely results delivery ‒ Filtering for IP addresses, applications, etc. • Analyzing data ‒ Automated analysis – Expert events ‒ Simple, intuitive workflow ‒ Data visualization from multiple perspectives #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 18
  • 19.
    10G Network AnalysisWorkflow Deploy 24x7 Monitoring Identify Key Analysis Pts NO Alarms/ Alerts Problem? YES Rewind Data #wp_forensics Analyze Network Forensics for Wired and Wireless Networks Tune if Necessary © WildPackets, Inc.
  • 20.
    A Solution forEvery Network #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 20
  • 21.
    Data Capture fromHigh-Speed Links #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 22.
    Forensic Analysis –Capturing An Attack 2. Data Recorder records and aggregates data throughout attack IDS/IPS System 3. Event logged, attack partially tracked by IDS Servers 1. Attack bypasses firewall #wp_forensics 4. Post event analysis reveals attacker, method, damage! Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 23.
    10G Network DataStorage • 1Gbps steady-state traffic assuming no storage overhead: 7.68 GB/min 460 GB/hr 11 TB/day 2.9 days in a 32TB appliance • 10Gbps: 76.8GB/min 4.6 TB/hr 110 TB/day 28 hours in a 128TB appliance #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 24.
    Wired vs. WirelessNetwork Forensics © WildPackets, Inc. www.wildpackets.com 24
  • 25.
    802.11ac – Breakingthe Gigabit Barrier Gratuitous clipart - Please ignore 11 Mbps 1-2 Mbps 802.11b <1 Mbps 802.11 1997 550% 100% Proprietary 1989 #wp_forensics 1991 1999 433/866/1300+ Mbps 802.11ac 288% (vs. 450) (to 6.93 Gbps) 300/450/600 Mbps 802.11n 54 Mbps 833% 802.11g/a 490% 2003 2009 2013 Source: Farpoint Group Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 26.
    #wp_forensics Network Forensics forWired and Wireless Networks © WildPackets, Inc. 26
  • 27.
    Additional Drivers forWireless Forensics • BYOD ‒ No configuration control ‒ Limited or no access to the end-user device ‒ Problems reported “after the fact” • Point-of-Presence required ‒ Wireless data must be captured within a few hundred feet of the device ‒ Vastly more collection points than for wired forensics • Data volumes that rival wired data ‒ 1.3Gbps will be common with 802.11ac ‒ Mobile devices outnumbering wired devices #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 27
  • 28.
    Wireless Forensics Solution •As wireless approaches wired speeds, it’s time to start relying on the wire • Distributed analysis using deployed assets – APs – is the only effective solution as wireless speeds grow • 24/7 capture/analysis ensures problems aren’t missed • Recording enables wireless forensic analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 28
  • 29.
    Wireless Forensics Benefits •Reduce MTTR • Prioritize analysis tasks ‒ No need to reproduce a problem ‒ No need to wait for it to happen again • Increase WLAN service uptime ‒ WLANs are now missioncritical ‒ Mobility implies you won’t be near the problem ‒ Deal with emergencies immediately ‒ Handle routine investigations as time permits ‒ Save data for long-term analysis • Reduce reaction time ‒ Data are always available for analysis • Reduce analysis costs ‒ A single solution for wireless and wired analysis #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 29
  • 30.
    Use Cases © WildPackets,Inc. www.wildpackets.com
  • 31.
    Use Cases forNetwork Forensics • Finding proof of a security attack • Troubleshooting intermittent performance issues • Monitoring user activity for compliance with IT and HR policies • Identifying the source of data leaks • Monitoring business transactions • Verifying VoIP and video over IP performance #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 31
  • 32.
    Best Practices forNetwork Forensics Capturing Network Traffic 1. Capture traffic continuously 2. Deploy a solution that captures traffic reliably 3. Set up filters to catch anomalies Storing Traffic 4. Allocate sufficient storage for the volume of data being collected 5. Adjust file sizes for the desired performance optimization #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 32
  • 33.
    Best Practices forNetwork Forensics (cont.) Analyzing Traffic 6. Select a network forensics solution that supports filters and searches that are fast, flexible, and precise 7. Record baseline measurements of network performance 8. Use filters to zoom in on the problem at hand #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 33
  • 34.
    Performing Forensic Analysis ©WildPackets, Inc. www.wildpackets.com
  • 35.
    WildPackets – TheNetwork Forensics Myth Buster Myth Busted Can’t analyze at 10G line rate Dropped packets Captured data is not reliable Inability to collect packets at all network locations Inadequate real-time stats Real-time analysis no longer an option Limited visibility into VoIP Inability to analyze/search recorded traffic No end-to-end visibility into application transactions Limitations in security monitoring #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc. 35
  • 36.
    Q&A Show us yourtweets! Use today’s webinar hashtag: Follow us on SlideShare! #wp_forensics Check out today’s slides on SlideShare www.slideshare.net/wildpackets with any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
  • 37.
    WildPackets Corporate Overview OptimizingNetwork and Application Performance © WildPackets, Inc. www.wildpackets.com
  • 38.
    Corporate Background • Expertsin network monitoring, analysis, and troubleshooting ‒ Founded: 1990 / Headquarters: Walnut Creek, CA ‒ Offices throughout the US, EMEA, and APAC • Customers spanning leading edge organizations ‒ Mid-market and enterprise lines of business ‒ Financial, manufacturing, ISPs, major federal agencies, state and local governments, universities ‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000 • Award-winning solutions that improve network performance ‒ Internet Telephony, Network Magazine, Network Computing awards ‒ United States Patent 5,787,253 issued July 28, 1998 • “Apparatus and Method of Analyzing Internet Activity” #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 39.
    Why Our CustomersNeed Us • VoIP, video, cloud, virtualization, and key business applications are saturating critical network services • Evolving network technologies create discontinuities ‒ 1 Gig  10 Gig  40 Gig  100 Gig networks ‒ Wireless, BYOD initiatives • Users and business can not tolerate network problems for mission critical services Increasing demand for better real-time network visibility, network analytics, network forensics, and DPI #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 40.
    How We CreateValue We provide innovative, industry-leading, real-time network performance management solutions ‒ Easy-to-use, easy-to-learn user interface ‒ Uniquely extensible solutions ‒ Wireless network leadership ‒ Detailed analytics related to network applications ‒ Fastest network traffic capture appliance in its class ‒ Technical superiority at competitive price point WildPackets has continually advanced its solution to meet the needs of its customers #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 41.
    Unprecedented Network Visibility NETWORKHEALTH GLOBAL WatchPoint can manage and report on key device performance and availability across the entire network, from anywhere on the network. UNDERSTAND END-USER PERFORMANCE DISTRIBUTED Omnipliance network analysis and recorder appliances monitor and analyze performance across critical network segments, virtual environments, and remote sites. PINPOINT NETWORK ISSUES ANYWHERE PORTABLE Omnipliance Portable can rapidly identify and troubleshoot issues before they become major problems—wired or wireless—down the hall or across the globe. ROOT-CAUSE ANALYSIS DPI #wp_forensics OmniPeek network analyzer performs deep packet inspection and can reconstruct all network activity, including e-mail and IM, as well as analyze VoIP and video traffic quality. Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 42.
    A History ofInnovation 2001 2005 2009 2011 • First 802.11 wireless analyzer • First network analyzer with automated expert analysis Combined distributed network and VoIP network analysis Innovative dashboard with drill-down for VoIP and video • Total visibility with zero packet loss • First wireless network analyzer to support capture and analysis of 802.11n 3-stream wireless 2008 2010 2012 2013 Distributed real-time Enterprise-wide troubleshooting Monitoring and Reporting First to achieve 11 Gbps sustained capture-to-disk • Capture, record, and analyze from 40G network segments • First wireless network analyzer to support 801.11ac, k, r, u, v, w Industry leading network analysis and recorder appliances 2003 #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 43.
    Product Line Overview ©WildPackets, Inc. www.wildpackets.com
  • 44.
    Omni Distributed AnalysisPlatform OmniPeek Enterprise Packet Capture, Decode and Analysis • Ethernet,1/10 Gigabit, 802.11, and voice and video over IP • Portable capture and OmniEngine console • Aggregate analysis data across multiple capture points Omnipliance Network Analysis and Recorder Appliances • High-performance packet capture and real-time analysis • Stream-to-disk for forensics analysis • Integrated OmniAdapter network analysis cards up to 40G WatchPoint Centralized Enterprise Network Monitoring Appliance • Aggregation and graphical display of network data • WildPackets OmniEngines • NetFlow and sFlow #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 45.
    Omni Distributed AnalysisPlatform Software and Turnkey Solutions • Enterprise monitoring and reporting ‒ WatchPoint Server ‒ OmniFlow, NetFlow, and sFlow Collectors • Network Analysis and Recorder Appliances ‒ Omnipliance CX, MX, TL ‒ Optional OmniStorage ‒ OmniAdapter analysis cards • Distributed analysis software ‒ OmniPeek – Enterprise, Professional, Basic, Connect ‒ OmniPeek Remote Assistant ‒ OmniEngine Enterprise • Portable solutions ‒ OmniPeek network analyzer ‒ Omnipliance Portable #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 46.
    OmniPeek Network Analyzer •Distributed analysis manager – Connect to and configure distributed OmniEngines and Omnipliances, • Comprehensive dashboards present network traffic in real-time – Vital statistics and graphs display trends on network and application performance – Visual peer-map shows conversations and protocols – Intuitive drill-down for root-cause analysis of performance bottlenecks • Visual Expert diagnosis speeds problem resolution – Packet and payload visualizers provide business-centric views • Automated analytics and problem detection 24/7 – Easily create filters, triggers, scripting, advanced alarms, and alerts #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 47.
    OmniPeek Remote Assistant Distributed,End-user Packet Capture Made Simple • Simple to deploy, simple to use ‒ Remote push, download from server, or even email ‒ Simple user interface - eliminates confusion for end user ‒ Full fidelity capture - see exactly what the PC sees ‒ Wired or wireless Trouble call from remote site network response is slow. • Encrypted file ‒ Only the analyst can open it ‒ Different encryption keys for different locations or customers User downloads and installs OmniPeek Remote. Encrypted capture data sent back for analysis. • Detailed client-side/end-user experience analysis • Perfect for Tech Support or IT Desktop support #wp_forensics Network Forensics for Wired and Wireless Networks Network analyst uses OmniPeek Enterprise to quickly troubleshoot problem without leaving the office. © WildPackets, Inc.
  • 48.
    OmniWiFi USB WLANCapture Adapter • A single device for all WLAN packet capture needs • Driver included with Omni v7.9 CDs • Tested and supported with OmniPeek and OmniEngine • Product features: • • • • • • USB device with extension cable Dual band operation – 2.4GHz and 5GHz Supports all standard international 802.11 channels (a/b/g/n) Supports 802.11n - 3 transmit/receive streams (450Mbps) Supports 802.11n 20MHz and 40MHz channel operation Supports multi-channel aggregation and roaming • Technical Details: ‒ Size (LWH): 6 inches, 1.5 inches, 5.5 inches ‒ Weight: 5.6 ounces NOTE: • Capture ONLY – no network services • Does not capture 802.11ac • Available via Amazon - $99/each #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 49.
    New Network Analysisand Recorder Appliances Powerful Precise Affordable The new family of WildPackets Network Analysis and Recorder appliances gives IT organizations powerful and precise analysis of high-speed networks in an affordable solution with half the hardware footprint of rival offerings. #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 50.
    Powerful ‒ Fastest networkrecorder in its class! Captures traffic up to 20Gbps of realworld traffic (all size packet distribution) ‒ Scales up to 128 TB of storage ‒ Provides simultaneous real-time analysis and a comprehensive Forensic Search that rapidly searches through terabytes of captured traffic for the details relevant to an investigation Precise ‒ Captures complete network traffic, so you can analyze everything, not just samples or high-level statistics ‒ Doesn’t drop packets or sacrifice accuracy for speed ‒ Supports rich, detailed analysis, including VoIP and video-over-IP traffic Affordable ‒ Delivers outstanding price/performance (lower price; half the rack space) ‒ Allows mix of 1G/10G/40G interfaces without buying extra appliances ‒ Solutions start at $16,995 Your network is bigger and faster. Now your analysis solution is, too. #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 51.
    Omnipliance TL Industry LeadingNetwork Analysis and Recorder Appliance • Sets a new standard in capture-to-disk speeds ‒ 20Gbps sustained capture to disk rate with zero packet drop • Best price/performance Network Analysis Appliance in the market ‒ 20Gbps with only one Omnipliance TL + OmniStorage ‒ Consuming less rack space, less cooling, less electrical power • Most flexible network interface offering ‒ 1G/10G/40G interfaces supported in a single unit eliminates additional unit requirement • Most accurate real-time analytics ‒ Packet-based processing and analysis vs. inaccurate samplebased calculation #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 52.
    WildPackets Network AnalysisRecorder Appliances Price/Performance Solutions for Every Application Portable Omnipliance CX Omnipliance MX Omnipliance TL Ruggedized Troubleshooting Less Demanding Networks Remote Offices Datacenter Workhorse Easily Expandable Enterprise, HighlyUtilized Networks Aluminum chassis / 17” LCD 1U rack mountable chassis 3U rack mountable chassis 3U rack mountable chassis 24GB RAM 16GB RAM 32GB RAM 64GB RAM 2 PCI-E Slots 2 PCI-E Slots 4 PCI-E Slots 4 PCI-E Slots 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 6TB Storage 4/8/16TB Storage 16/32TB Storage 32/48/64TB Storage Optional OmniStorage: 32/48/64TB Up to 128TB total Storage OmniAdapter 1G and 10G OmniAdapter 1G/10G MX OmniAdapter 1G/10G MX OmniAdapter 1G/10G/40G 6.5Gbps CTD 3.8Gbps CTD 8.8Gbps CTD 20Gbps CTD with OmniStorage #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 53.
    WatchPoint Centralized Monitoring forDistributed Enterprise Networks • High-level, aggregated view of all network segments – Monitor per campus, per region, per country • Wide range of network data – NetFlow, sFlow, OmniFlow • • • #wp_forensics Network Forensics for Wired and Wireless Networks Web-based, customizable network dashboards Flexible detailed reports Direct link to detailed, packet-based analysis © WildPackets, Inc.
  • 54.
    Comprehensive Support andServices Standard Support     Premier Support Maintenance and upgrades Telephone and email contacts Knowledgebase MyPeek Portal     24 x 7 x 365 Dedicated escalation manager 2 customer contacts per site Plug-in reconfiguration assistance WildPackets Training Academy  Public, web-based, and on-site classes  Complete curriculum: technology and product focused  Practical applications and labs covering network analysis, wireless, VoIP monitoring and advanced troubleshooting Consulting and Custom Development Services  Deployment, configuration, and assessment engagement  Systems integration and testing  Application integration, driver, decode, interface development #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 55.
    WildPackets Key Differentiators •Visual Expert intelligence with intuitive drill-down – Let computer do the hard work, and return results, real-time – Packet /payload visualization is faster than packet-per-packet diagnostics – Experts and analytics can be memorized and automated • Automated capture analytics – Filters, triggers, scripting, and advanced alarming system combine to provide automated network problem detection 24x7 • Multiple issue network forensics – Can be tracked by one or more people simultaneously – Real-time or post capture • User-extensible platform – Plug-in architecture and SDK • Aggregated network views and reporting – NetFlow, sFlow, and OmniFlow #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 56.
    24x7 Network Monitoring, Analysis,and Troubleshooting #wp_forensics Network Forensics for Wired and Wireless Networks © WildPackets, Inc.
  • 57.
    Thank You! WildPackets, Inc. 1340Treat Boulevard, Suite 500 Walnut Creek, CA 94597 (925) 937-3200 © WildPackets, Inc. www.wildpackets.com