1. Practical Network Security: Experiences with ntop Luca Deri Stefano Suin

2. Terena 2000Practical Network Security2 Daily Network Security Problems Frequent security violations. Need to detect unauthorized services installed by users. Who is generating suspicious traffic? Identification of misconfigured and faulty hosts.

3. Terena 2000Practical Network Security3 What Do We Need ? Traffic measurement. Traffic characterisation and monitoring. Detection of network security violations. Network optimisation and planning.

4. Terena 2000Practical Network Security4 What’s available on the Internet? Tcpdump, NeTraMet and RMON should be used by experts and are really not suitable for security problems. NFR and Snort are good, but they control only what is specified (Misuse Detection IDS).

5. Terena 2000Practical Network Security5 Requirements: Security Ability to automatically (i.e. no configuration) detect common network problems. Track ongoing attacks and identify potential security holes. Rule language for advanced intrusion detection.

6. Terena 2000Practical Network Security6 Welcome to ntop

7. Terena 2000Practical Network Security7 ntop Architecture

8. Terena 2000Practical Network Security8 Ntop Security Features TCP/IP Stack Verification. Application Misuse. Intruders Detection.

9. Terena 2000Practical Network Security9 TCP/IP Stack Verification [1/2] Invalid packets (ping of death, WinNuke). Stealth Scanning. Improper TCP Three Way Handshaking (e.g. queso/nmap OS Detection). Synflood.

10. Terena 2000Practical Network Security10 TCP/IP Stack Verification [2/2] Overlapping Fragments. Peak of RST Packets. Unexpected SYN/ACK (sequence guessing) and SYN/FIN (portscan) packets. Smurfing (ICMP to broadcast address).

11. Terena 2000Practical Network Security11 Application Misuse Buffer Overflow. Unauthorised Application Usage (e.g. Napster, ICQ). Misconfigured Applications (e.g. peak of DNS, NTP requests).

12. Terena 2000Practical Network Security12 Intruders Detection Trojan Horses (e.g. BO2K). Spoofing (more MAC addresses match the same IP address). Spy Detection (neped). Network discovery (via ICMP, ARP).

13. Terena 2000Practical Network Security13 Ntop IDS Rules icmp route-advertisement ICMP_REDIRECT !gateway/any action alarm tcp root-ftp any/ftp any/any contains "230 User root logged in." action alarm udp new-port-open any/any any/!usedport action alarm

14. Terena 2000Practical Network Security14 Ntop Availability Home Page: http://www.ntop.org/ Platforms: Win32 and Unix. License: Gnu Public License (GPL).