Network Security Monitoring is a technique developed by Richard Bejtlich (The Tao of Network Security Monitoring, AW 2004). In brief, NSM means to capture network traffic four different ways, to provide a security analyst with the greatest, and most useful, amount of informantion for analyzing security incidents that involve the monitored networks.

In this presentation, I will outline how NSM works, its benefits, then focus on the one tool that Richard recommends using even if the rest of the system gets ignored. Argus is a session data collector, a tool that collects packet headers and converts them into succinct transaction records. Argus allows you to see which IP addresses communicate, how much data was sent, the ports used, and TCP states for the transaction. While argus itself is easy to use, it produces binary output which must be translate using ra (report argus). You can even start using argus after an incident has occurred, because the network traces will help you to identify involved hosts.

I will demonstrate argus and show how you can use ra to uncover compromised hosts in your networks.

The talk will end with some slides and discussion about the future of computer security.