Tech Insight: Making The Most Of Open-Source Forensics Tools

A Special Analysis for Dark Reading

Network forensic solutions come in many different shapes, sizes, and price ranges, but in the end they all have the same goal: recording activity on the network. As IT budgets tighten with the economy, it might be time for your organization to take a closer look at a do-it-yourself approach to forensics that leverages free and open-source tools.

While your CFO might love the price of these tools, it may be difficult to "sell" them to your IT management. Most IT executives want someone to point a finger at when a product breaks, and many want 24x7 support. While some of the free and open-source tools do have ties with a company that can be paid for support, most do not.

But don't let the support question turn you away. Today's open-source network forensic tools are incredibly capable, and they can run on old hardware sitting around your shop. Your cost: little to nothing. In the current economy, that's a pretty compelling business case.

Making the case to build your own network forensics capabilities often means highlighting the shortcomings of your company's existing tools. For example, you should explain to management that while your intrusion-detection system (IDS) implementation is great, it lacks context to know whether an attack was successful. A network forensic tool recording all traffic can show what happened at the network level -- during and after an attack.

Network forensic tools also fill in the blanks when performing internal investigations. System logs show that a user logged in, but little else. With all traffic captured to disk, network forensics can often show what was accessed and when. Files can even be extracted from the captured traffic.

Building a basic network forensic system -- including installing the software and deploying it -- can be accomplished quickly. But teams looking to take the initiative and get the most out of it should do their homework first. Basic questions to help define the project include:

The decision to capture all traffic or only network flow data depends on the purpose of the collected data, network layout, and bandwidth. Collecting network flow data is equivalent to a phone bill, which shows which number called another number, at what time, and for how long.

When you collect only network flow data, no actual content is captured, which has pros and cons. The pros are that storing flow data doesn't take up much space, and you can use the existing network hardware's ability to export flow data. On the other hand, because you're not collecting content, you may not have all of the information you need to determine what really happened.

Your placement of capture devices will depend on your organization's motivation for implementing the forensics tools. If your primary goal is just to fill in the gaps of IDS, placing devices just behind the Internet gateway will probably suffice. However, if you want to address concerns like insider threats, capture points should also be set up at network choke points to capture user activity between the Internet and the data center.

Determining how far back to keep captured data is an internal decision that again depends on your goals for the network forensics solution. For supplementing an IDS, a couple of months should suffice. Six to 12 months might be more appropriate for internal investigations and insider threat concerns. Think about why you want to do the monitoring, how much bandwidth is on your network, and what your available hardware can handle. After considering those factors, you may decide to capture more data -- or less.

With free and open-source tools, network forensics can be done on the cheap. Often, you can do it with no more than an inexpensive 1U server or existing hardware, a large hard drive, and a network tap or monitoring port on a switch. A plethora of low-cost software can be had that can capture all traffic or just network flow data.

Daemonlogger, tcpdump, and tshark are three examples of free, open-source tools that do a great job of capturing network traffic to the disk. Each one supports ring-buffering, so you can define how much data they should store on disk (by percentage), how to split the different capture files (by time or size), and how to automatically overwrite the oldest files.

Once you have the network data captured to disk, you can use other low-cost tools for analysis, such as Wireshark, NetWitness Investigator, or NetworkMiner. And even if you use an off-the-shelf IDS, you can still use the open-source Snort as a "second opinion" on the captured traffic.

Doing network forensics yourself is an alternative, no matter what your organization's size or financial situation. Free tools have been developed to record the data to disk and to analyze the contents. In this economy, it's certainly an option worth considering.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.