Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 81 / 588

2-31
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 2 Reporting and Mitigation Devices Overview
Data Enabling Features
•
Ingress and egress interfaces
• Packets exchanged
•
Number of bytes transferred
Periodically, a collection of flows and its associated parameters are packaged in an UDP packet
according to the NetFlow protocol and sent to any identified collection points. Because data about
multiple flows is recorded in a single UDP packet, NetFlow is an efficient method of monitoring high
volumes of traffic compared to traditional methods, including SYSLOG and SNMP.
The data provided by NetFlow packets is similar to that provided by SYSLOG, SNMP, or Checkpoint
LEA as reported by enterprise-level firewalls, such as Cisco PIX, NetScreen ScreenOS, and Checkpoint
Firewall-1. The difference being that NetFlow much more efficient. To receive comparable syslog data
from a firewall device, the syslog logging level on the firewall must be set to DEBUG, which degrades
firewall throughput at moderate to high traffic loads.
If NetFlow-enabled reporting devices are positioned correctly within your network, you can use NetFlow
to improve the performance of the MARS Appliance and your network devices, without sacrificing
MARS’s ability to detect attacks and anomalies. In fact, NetFlow data and firewall traffic logs are treated
uniformly as they both represent traffic in the network.
This section contains the following topics:
• How MARS Uses NetFlow Data, page 2-31
•
Guidelines for Configuring NetFlow on Your Network, page 2-32
• Enable Cisco IOS Routers and Switches to Send NetFlow to MARS, page 2-32
•
Configuring Cisco CatIOS Switch, page 2-34
• Enable NetFlow Processing in MARS, page 2-34
How MARS Uses NetFlow Data
When MARS is configured to work with NetFlow, you can take advantage of NetFlow’s anomaly
detection using statistical profiling, which can pinpoint day zero attacks like worm outbreaks. MARS
uses NetFlow data to accomplish the following:
•
Profile the network usage to determine a usage baseline
•
Detect statistically significant anomalous behavior in comparison to the baseline
• Correlate anomalous behavior to attacks and other events reported by network IDS/IPS systems
After being inserted into a network, MARS studies the network usage for a full week, including the
weekend, to determine the usage baseline. Once the baseline is determined, MARS switches to detection
mode where it looks for statistically significant behavior, such as the current value exceeds the mean by
2 to 3 times the standard deviation.
By default, MARS does not store the NetFlow records in its database because of the high data volume.
However, when anomalous behavior is detected, MARS does store the full NetFlow records for the
anomalous entity (host or port). These records ensure that the full context of the security incident, such
as the infected source and destination port, is available to the administrator. This approach to data
collection provides the intelligence required by an administrator without affecting the performance of
the MARS Appliance. Storing all NetFlow records consumes unnecessary CPU and disk resources.
Note MARS only supports NetFlow version 5 and version 7.