Fighting Virus and Hack Attacks With a Network Analyzer

Enterprise Networks & Servers, Sep 2004 by Thompson, Charles

Most IT administrators reap the benefits of a network analyzer to watch the network, identify issues and be alerted of problem scenarios. What is not widely understood is that these features make the analyzer an excellent tool to locate network security breaches, and to help identify and isolate virus-infected systems. In fact, a network analyzer can be a strong force to enhance network security. But which analyzer features are essential for this task? The purpose of this article is to explain how an analyzer can augment firewalls and other perimeter defenses.

How Analyzers Work

A protocol analyzer shows you what is happening on your network by decoding the different protocols that devices on the network use to communicate, and presenting the results in human-readable form. Most mature analyzers also include some statistical reporting functionality. By watching network traffic, understanding bandwidth utilization, reviewing connection dynamics, administrators can easily determine what station is causing the problem and why.

Every administrator of a corporate LAN of any size these days has already built strong defenses against hackers and virus attacks. But the viruses and hackers continue to get through. Why? Anti-virus and IDS systems are designed to prevent the incursion of known viruses and attacks.

The hackers and "script kiddies" have the same access to all the threat bulletins and Windows patches that you have, and are always looking for the new vulnerabilities. In short, your firewalls and operating systems often won't get a patch until the damage is already done. Imported disks, deliberate actions by employees, and visitors bringing infected laptops are some other weak spots in your security system that perimeter defenses alone cannot address.

Educational institutions are particularly vulnerable because of the tremendous variety of hardware and software platforms they must support. For example, systems and network administrator Nellie Shelton at the Presbyterian College in Clinton, S. C., uses a network analyzer to monitor and troubleshoot over 15 different VLANs. Over 90 percent of students live on-campus within 15 different residence halls. Students bring in a variety of computer hardware and software to connect to the campus network. As a result, university campuses offer large security concerns.

"Educational institutions offer very different challenges to a network administrator," said Shelton. "At most places of business, the hardware and software systems offered to an employee are already agreed upon by the IT department. Here, we have no control over what systems, devices or applications are brought into the network. It's a unique situation."

Find and Isolate Infected Systems

In the case of a security breach, a network analyzer can save valuable amounts of time in locating a virus. How does this work?

Viruses and hacker attacks typically generate a recognizable pattern or "signature" of packets. A network analyzer can identify these packets and alert the administrator to their presence on the network via e-mail or page. Most analyzers let you set alarms to be triggered when a particular pattern is seen. Some analyzers can be programmed to send an e-mail or page when these conditions are met. Of course, this assumes that the virus and its signature have been seen before and incorporated into the analyzer's list of packet filters. (A filter specifies the set of criteria under which an analyzer will capture packets or trigger an alarm or some other action.)

New viruses and worms have different signatures depending on the vulnerabilities they are trying to exploit, but once systems have been successfully breached, there are a relatively small number of things that hackers actually want to do with your network, the top ones being the following.

* Use your systems in a Denial of Service (DoS) on a third party. A good network analyzer can easily identify such systems by the traffic they generate.

* Use your system as an FTP server to distribute "warez" and other illegal files. You can configure an analyzer to look for FTP traffic or traffic volume where it is unexpected.

The very nature of viruses and worms is to produce unusual levels of network traffic. High frequency of broadcast packets or specific servers generating an unusual number of packets are logged in the analyzer's record of longer term traffic, allowing the administrator to follow up on suspicious traffic patterns.

The analyzer can also help in identifying inappropriate traffic which may leave your network open to attack, or may signify potential weaknesses. This would vary with the particular network or corporate policy, but could include automatic notification of traffic such as MSN, NNTP or outbound telnet.

Choosing an Analyzer

To be useful as a corporate security tool, the analyzer must be "distributed" so that it covers all the areas of your network. It must also be able to capture and decode all of the protocols from all of the media (Ethernet, WAN, 802.11, etc.) on which your corporate data flows. The other crucial feature is flexible filtering that allows triggered notification. A network analyzer can only capture and decode the information that it can "see." In a switched network environment, an analyzer is only able to see traffic local to the switch. To overcome this, most modern analyzers are supplied with multiple agents or probes that are installed on each switch in the LAN. An analyzer console can then query the probe for either raw packets or statistical traffic reports.