SPECIAL

Enterprise Network Instrumentation

Most network architecture and security books assume that gaining access to network traffic is a trivial endeavor. In reality, it can be difficult (and in some cases, nearly impossible) to monitor packets for performance, fault, security, and compliance reasons.

This seminar presents the world's only class devoted exclusively to enterprise network instrumentation. The class was originally built to meet a security product vendor's private requirements, and now Mr. Bejtlich is pleased to share it with the SANS community.

The class starts with a brief examination of network transmission technologies. It introduces the network infrastructure components, design basics, and access options found in modern networks. The course continues by offering advice on practical access techniques, best practices, open source network monitoring, and simple troubleshooting.

This class is for you, if:

• You want to know which of over a dozen varieties of network taps you should use to meet an assortment of monitoring tasks
• You need to measure packet loss for any application collecting network traffic through Berkeley Packet Filters
• You've always wanted to build a cross-over cable yourself
• You don't know the difference between a multi-mode fiber cable with LC connectors and a single-mode fiber cable with SC connectors
• You've run out of SPAN ports and need to see traffic using another approach
• And more! This is a practical class with solutions you can implement immediately, based on Mr. Bejtlich's consulting, research, and writing experiences.

Course Plan

Session One:

• Introduction
• Justifying network instrumentation
• Network transmission technologies
• Network infrastructure components
• Network infrastructure design basics
• Network access options Part 1

Session Two:

• Network access options part 2
• Practical access
• Common issues and best practices
• Open source network monitoring
• Simple troubleshooting

Intended Audience

This tutorial is designed for junior through advanced network security architects who must design, implement, and operate monitoring and visibility solutions.

Absolutely wonderful, both in presentation and content
-Don Seymour, TerpSys