Well, I can see the similitude, we both try to put a grin on people's face...
-----Original Message----- From: Van Der Meulen, Mark [mailto:[email protected]] Sent: Monday, July 11, 2011 7:31 AM To: Ziv Leyes; [email protected] Subject: RE: [c-nsp] OT: Following Up on Netflow Information And here we have people, the George Costanza of Network Admins. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Ziv Leyes Sent: Sunday, 10 July 2011 5:49 PM To: [email protected] Subject: Re: [c-nsp] OT: Following Up on Netflow Information I've always got the best results using a crowbar First time you approach the user with the crowbar in hand, and tell him, in a calm, polite way, that he should refrain from doing that again, whatever it was he was doing Second time, after finding out he persisted with his unwanted activity, you pay him a visit, come calm, and without saying a single word, smash his computer screen with the crowbar, in front of him (very important), and go away the same calm way you came. Third time (on most cases this won't be needed) you beat the heck out of him with the crowbar and go to jail with a huge smile on your face... Ziv -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Kevin Cullimore Sent: Saturday, July 09, 2011 2:04 AM To: [email protected] Subject: Re: [c-nsp] OT: Following Up on Netflow Information On 7/8/2011 11:58 AM, Jeff Cartier wrote: > Hi All, > > This might be a little off-topic to Cisco, but what the heck. > > I'm just curious as to how 'you' would go about tracking down a user that *may* possibly be downloading large amounts of data causing congestion on a link. For instance, I had a case this morning with an internal IP address of 10.x.x.x that showed a 900MB conversation over TCP 80 (HTTP) to an ip address of 174.120.5.220. > > Great - so its not that hard to track down the internal user. Yell at him to stop, talking to him about what he's doing to the network. No biggie. > > I'm more curious about options/tools available to find out what he was doing. I know that he was downloading something, I know that it was over HTTP and I know the outside IP address he was accessing. So I start off by looking at 174.120.5.220. I can check the A record which tells me nothing.... > Name: dc.5.78ae.static.theplanet.com.... I've encountered organizations that use commercial grade applications to proactively track this data, such as lancope(Stealthwatch)/riverbed(ManageEngine)/sourcefire(RNA). They enjoy some success when dealing with situations similar to those you describe, since these tools track netflow data over time, allowing profiles to be constructed (which may well contain the information you seek). Some of them integrate with user directories, which would certainly improve your chances. For customers without budget money, I've also deployed ntop rather effectively. > > I can't browse to that IP address. I can see who owns that IP address (XO Communications) though, but in this case its all useless. > > The question, more or less, is do I have any options to keep moving forward in finding out what this user was actually doing? It depends how long your organization stores log entries. Without a proactive monitoring tool in place, you'll almost certainly need to interface with individuals managing other parts of the infrastructure such as dhcp servers and/or snmp collectors and/or firewalls. The list of options often depends upon the higher-level details. As other posters have noted, it's difficult to outdo packet capture data when you're seeking actual insight. > Thanks in advance! > > __________________________________________________________________ > DISCLAIMER: This e-mail contains proprietary information some or all of which may be legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail. If you are not the intended recipient you must not use, disclose, distribute, copy, print, or rely on this e-mail. > > This message has been scanned for the presence of computer viruses, Spam, and Explicit Content. > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ************************************************************************ ************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************ ************ The information contained in this e-mail message and its attachments is confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender, and then delete the message from your computer. Thank you! ******** This mail was sent via Mail-SeCure System.******** ************************************************************************ ************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************ ************ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ******************************************************************************* Travelex - www.travelex.com Travelex Outsourcing Pty Limited [Currency Select businesss] is a limited company registered in Australia with company number: 127 747 586. Information in this email including any attachment ('email') is confidential, may be privileged and is intended solely for the addressee. Unauthorised recipients are requested to preserve the confidentiality of this email, advise the sender immediately of any error in transmission, and then delete the email from the recipient's mailbox without making copies. Any disclosure, copying, distribution or action taken, or omitted to be taken, in reliance upon the contents of this email by unauthorised recipients is prohibited and may be unlawful. Please note that no contracts or commitments may be concluded on behalf of Travelex Outsourcing Pty Limited [Currency Select businesss] or its groups of companies ('Travelex') by means of email, and no statement or representation made in this email is binding on behalf of Travelex. DISCLAIMER: Whilst this message has been scanned for viruses, Travelex disclaims any responsibility or liability for viruses contained therein. It is therefore recommended that all emails should be scanned for viruses. ******************************************************************************* ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************ The information contained in this e-mail message and its attachments is confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the sender, and then delete the message from your computer. Thank you! ******** This mail was sent via Mail-SeCure System.******** ************************************************************************************ This footnote confirms that this email message has been scanned by PineApp Mail-SeCure for the presence of malicious code, vandals & computer viruses. ************************************************************************************ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
