Need for NFR
Home ] Up ] [ Need for NFR ] Using the GUI ] Understanding Queries ] Understanding Backends and Packages ] Understanding Alerts ] Understanding Space Management ]


Need for NFR

With the ever changing environment of network computing, a need has been identified to protect and track network activity. The first phase was security tools such as firewalls. While firewalls do restrict access to and from networks, hackers can still break through a firewall and gain unauthorized access. This left systems that could still be broken into, a vulnerable network and data, and very little with which to track the intruder.

In the early 1990s, there were several security tools that were being used for logging who was accessing your network as well as what was happening. You could even send alerts to network managers if something unusual occurred. These systems were crude and cumbersome because they were being used for functions that they were not originally designed to perform. Other intrusion detection burglar alarms were created that focused on features of the host operating system, such as tcp_wrappers[8], klaxon[9], and tocsin[10].

The Network Flight Recorder (NFR) contains features found in many of the monitoring systems that were implemented in the past. What makes NFR unique is that the filtering and analysis process is internally programmed, rather than being static-coded into the monitoring application.

NFR includes a generalized and powerful filtering language called N code, as well as the ability to trigger alerts and log packet information. A triggering specification lets data be selected from reassembled TCP sessions, providing a powerful capability for usage measurement as well as audit. NFR is designed to allow you to explore auditing and logging, as well as provide a valuable data source for researchers working on intrusion detection.


Home ] Up ] Next ]