Home > Ask the Information Security Experts > Network security threat management Questions & Answers > How to address a spike in TCP and UDP flows
Ask The Security UK Expert: Questions & Answers
EMAIL THIS

How to address a spike in TCP and UDP flows

Peter Wood EXPERT RESPONSE FROM: Peter Wood

Pose a Question
Other Security UK Categories
Meet all Security UK Experts
Become an Expert for this site


Enterprise IT tips and expert advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 29 October 2009
I noticed an unusual spike in TCP and UDP flows from a single internal source to multiple destinations. What steps you would take to determine the type of traffic that this represents?

>
To address a spike in TCP and UDP flows, run a packet sniffer such as Wireshark or CommView on a hub connected to the target device. Both these programs give you the opportunity to filter traffic during capture and post-capture to determine what is going on. Filters can be set for individual ports or protocols, as well as source and destination IP addresses. You can also rebuild sessions using either of these tools. If the device is non-critical, you may wish to isolate it first, in case it has been infected with malware.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
Network security threat management
Database activity monitoring technology vs. SIEM tools
Is it enough to analyse log files, or is an IDS necessary?
What to look for in a network security audit
How secure are extended validation SSL certificates?
What should happen to users and devices that fail NAC policies?
When to use a unified threat management system
Cloud computing network security best practices
When IT security costs are cut, which security product is a must?
What considerations should be made when outsourcing IT infrastructure?
When running Wireshark, will adding a switch stop packet sniffing?

Network Security Monitoring: Tools and Systems
Network security 101: Default router settings, network hardening
Network security 101: Password policy best practices, security documents
Adobe vulnerability: Pen test firm finds ColdFusion admin page flaw
First of data loss prevention vendors touts downloadable DLP software
Law firm security gets positive verdict with UTM device
Database activity monitoring technology vs. SIEM tools
Security event log management streamlines netsec for call centre
Single sign-on technology for health care helps medics roam securely
Considerations for buying and implementing DLP solutions 2
Amid high network security cost, organisations explore internal savings

Threat and Vulnerability Management
Social networking: Workplace productivity, security no match for Facebook
McAfee-Intel: Why the McAfee acquisition is being met with scepticism
Network security 101: Default router settings, network hardening
Network security 101: Password policy best practices, security documents
Adobe vulnerability: Pen test firm finds ColdFusion admin page flaw
ISACA issues mobile smartphone security policy guidance
Zeus Trojan: Data-stealing malware transfers £675,000 from UK bank
Survey: Web 2.0 security issues cause concern
Spy recording devices can be thwarted by portable USB security policy
Microsoft issues temporary fix for Windows Shell zero-day

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
Centre for the Protection of National Infrastructure  (SearchSecurityUK.com)
Serious Organized Crime Agency  (SearchSecurityUK.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary







Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Access Management: Authentication, Biometrics, Password Security
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




All Rights Reserved, Copyright 2008 - 2010, TechTarget | Terms of Use | Read our Privacy Policy
  TechTarget