0

min read

May 22, 2024

Want to learn more about NetFlow? Here's a useful analogy to get you started

Infographic explaining NetFlow using a train analogy, with a train passing a router station, introducing NetFlow as a tool for monitoring malicious activity and improving internet security

NetFlow train analogy: internet data packets are like boxcars on trains traveling between cities, and routers are the depots that direct them along the tracks to their destination

NetFlow sampling explained: like depot workers counting one boxcar per train, routers sample about 1 in 3,000 to 1 in 10,000 packets and record source IP, destination IP, ports, and packet counts, but not content

How NetFlow data supports threat intelligence: spotting boxcars of a certain size and color reveals the source and destination of illicit shipments, much like tracking traffic to command and control (C2) servers

NetFlow conveys no content: it confirms communication between two endpoints, helping defenders reveal malicious infrastructure behind DDoS, ransomware, and credential theft

‍

Related Posts

Relaying to the Frontier

From the disk to the flows: ransomware infrastructure analysis of Akira, DragonForce, Clop, and other ransomware gangs

From the Disk to the Flows: Ransomware Infrastructure Analysis

The transaction is the last step, not the first: spotting fraud attack patterns earlier with threat intelligence

The Transaction Is the Last Step, Not the First

Cl0p Til You Drop: Cl0p ransomware threat intelligence research on managed file transfer attack campaigns

Cl0p Til you Drop - 6 Years, 10 Campaigns, 8 Zero-Days