Help Irongeek.com pay for bandwidth and research equipment:
Pivot2Pcap: a new approach to optimzing cybersecurity operations by tightly coupling the big-picture view provided by Netflow with the in-depth resolving power of PCAP. SkyDogCon 2012 (Hacking Illustrated Series InfoSec Tutorial Videos)
Pivot2Pcap: a new approach to optimzing cybersecurity operations by tightly coupling the big-picture view provided by Netflow with the in-depth resolving power of PCAP.
In large networks, it helps to work from the big picture on down when planning
for defense. This allows security professionals to watch over the entire network
(breadth) for anomalous or suspicious activity. When any such activity is
observed, it can then be investigated deeply (depth) to determine the nature of
the threat. Once the behavior is fully understood, a switch back to the broad
view can reveal whether this same pattern of activity is visible elsewhere in
the network. In this way, it is possible to quickly determine how widespread a
threat might be, and when and where it began.
Two common types of network data provide these broad and deep views: network
flow data (Netflow) and packet capture (PCAP). Pivot2Pcap allows cybersecurity
analysts to pivot back and forth between the broad view provided by the flow
index, and the deep, drill-down view of the packet store. Both perspectives have
complementary value in isolating and resolving cybersecurity operations issues.
Peter Shaw is one of the co-founders of nPulse Technologies. His 23 years of
experience in the computing, telecommunications, networking and security
industries include leadership roles in business strategy, product management and
marketing in the US, Europe and Asia. Peter has held global, VP-level positions
at Endace, Allied Telesyn, Agilent Technologies and Hewlett Packard. He holds a
degree in electrical engineering and computer science from the University of
Auckland, and has also completed post-graduate business studies programs in the