Normally, to carry out this task, we must configure an interface of the switch of our network in monitor mode (mirroring or SPAN), usually the one that connects us with the firewall, and configure the switch to forward all the traffic to a computer where we have the analyzer; this configuration can also be found in NIDS implementations, since broadly speaking, they work in a similar way.
For the capture of traffic from our network, there are however other options that are based on the capture made in the firewalls of our network, or if we are carrying out the analysis of a large network, it is possible that it has Cisco equipment with Cisco NX-OS system (old SAN-OS), an operating system designed for datacenter environments. These systems can facilitate the task of traffic analysis in the control plane, that is, the traffic that maintains the functionality of the network (routing protocols, network infrastructure management,..).
The Cisco NX-OS system is implemented in state-of-the-art communications equipment, such as the Cisco Nexus 7000 series (or Nexus 5000), a highly scalable modular platform that supports speeds of 10Gigabit Ethernet (and even 100Gbps), designed to unify LAN and SAN environments, turning the Nexus equipment into multiple switches logical, which run completely independent processes. To facilitate tasks such as network analysis, these systems incorporate the Ethanalyzer command, based on version 1.0.8 of Wireshark, which allows us to comfortably capture and decode network packets, using the same type of filters as the original tool, being able to save the different captures to analyze them later.
Although due to its cost it is unlikely that most of our readers will have a system like those described, for those who are lucky enough to be able to manage them, Ethanalyzer can make their lives a little easier. The others will have to settle for the server version of Wireshark, which is no small feat.
Author: Jose L. Villalón
Source: Security ArtWorks
Authors: Computer Security News
