topic Re: Junk traffic in General Topics

Junk traffic

jdprovine — Fri, 10 Feb 2017 14:49:57 GMT

Is there a good way to verify good traffic from junk traffic.?

Re: Junk traffic

reaper — Fri, 10 Feb 2017 15:50:32 GMT

Hi !

That's a tricky one!

the only real way to filter out good from junk is to 'know' the network

this will most likely require a little legwork where you talk to whomever is responsible for a set of servers to see if they can tell you which connections are needed and which arent, which in most cases will result in the sysadmin replying "ALL PORTS NEED TO BE OPEN" or something along those lines 😉

you can go about creating some custom reports that highlight the overall app category, that should split up most 'business' traffic from 'not so business' and then you can tune from there

Re: Junk traffic

jdprovine — Fri, 10 Feb 2017 16:57:39 GMT

Good idea reaper I have been trying to use the ACC too. I am trying to tighten up our DMZ 😛

Re: Junk traffic

BPry — Fri, 10 Feb 2017 18:21:25 GMT

Sadly DMZs take a long time to actually secure properly if they are already running production services. Mgmt doesn't want you to bring anything down, but at the same time I've seen DMZ that was configured to allow anything between their internal zone and had outside RDP open to the servers. Took me a very long time to explain that they had destroyed any reason to have a DMZ in the first place.

Re: Junk traffic

jdprovine — Fri, 10 Feb 2017 20:51:49 GMT

I hear ya Bpry