Re: Network flow log consolidation

[Tristan RHODES <TristanRhodes () WEBER EDU>]

You should take a look at NFSEN.  NFSEN is a web-based graphical
front-end to NFDUMP, which is a netflow collector.  NFSEN displays
graphs of data collected from netflow, and it also allows you to create
very precise queries on large amounts of data.  This is a great tool for
netflow-based forensics and for quickly identifying traffic patterns
that stand-out from the baseline.

NFSEN
http://nfsen.sourceforge.net/

NFDUMP
http://nfdump.sourceforge.net/

Tristan Rhodes
Weber State University

> > > lcb () UCSD EDU 04/25/06 1:18 PM >>>
Tangential to the discussion of syslog parsing, are any others on the
list evaluating or implementing products to consolidate network flow
logs? This would be a precursor to trend analysis and perhaps some
security event correlation processes.

I have looked at some products in a past position and am wondering
which
products or systems you find valuable.

--
Logan Browne, CISSP, CISM
Network Security Manager
University of California, San Diego
<lcb () ucsd edu>
(858)822-5343