Junk traffic

[jdprovine]

Is there a good way to verify good traffic from junk traffic.?

[reaper]

Hi !

That's a tricky one!

the only real way to filter out good from junk is to 'know' the network

this will most likely require a little legwork where you talk to whomever is responsible for a set of servers to see if they can tell you which connections are needed and which arent, which in most cases will result in the sysadmin replying "ALL PORTS NEED TO BE OPEN" or something along those lines 😉

you can go about creating some custom reports that highlight the overall app category, that should split up most 'business' traffic from 'not so business' and then you can tune from there

[jdprovine]

Good idea reaper I have been trying to use the ACC too. I am trying to tighten up our DMZ 😛

[BPry]

Sadly DMZs take a long time to actually secure properly if they are already running production services. Mgmt doesn't want you to bring anything down, but at the same time I've seen DMZ that was configured to allow anything between their internal zone and had outside RDP open to the servers. Took me a very long time to explain that they had destroyed any reason to have a DMZ in the first place. 

[jdprovine]

I hear ya Bpry