How Network Technologies Affect Visibility

What it is

Many ordinary network technologies change, hide or split traffic, and that changes what a security analyst can see.

An analyst reading logs or captures must know which technology sat in the path. Otherwise a log line may point to the wrong host, or a lack of data may be mistaken for a lack of activity.

This page walks through eight technologies and the effect each one has on visibility.

How it works

Each technology either removes detail from the data, adds a layer around it, or changes which device the analyst sees.

Access control lists

An access control list (ACL) permits or denies traffic by address, port and protocol. Denied traffic never reaches the target, so a sensor behind the ACL sees nothing of it. Logging on the ACL itself, or on the firewall, gives a record of what was blocked.

R1(config)# access-list 101 deny tcp any host 10.1.1.10 eq 23 log
R1(config)# access-list 101 permit ip any any

The log keyword makes the router record matches, which gives the analyst some visibility.

NAT and PAT

Network address translation (NAT) swaps one address for another. Port address translation (PAT) lets many internal hosts share one public address by using different source ports.

A log outside the NAT device shows only the public address. The analyst cannot tell which inside host sent the traffic without the translation table.

R1# show ip nat translations

That command lists the inside local and inside global addresses and ports, which maps public activity back to a private host.

Tunnelling and encapsulation

Encapsulation wraps one protocol inside another. A tunnel carries traffic inside a different protocol, as a VPN does. The outer header shows only the tunnel endpoints, so the inner source, destination and content are hidden from tools that watch the path.

Analysts need to look at the traffic at the tunnel endpoints, where it is decrypted or unwrapped. Tunnelling can also be abused to sneak data past controls.

Encryption

Encryption hides the payload. A sensor on the path still sees addresses, ports, sizes and timing, and some details of the handshake, but not the content.

Inspection of encrypted traffic needs a device that decrypts it, or analysis of the endpoint where it is clear. This is a major challenge for intrusion detection.

Tor

Tor routes traffic through several volunteer relays, with layers of encryption. The destination sees the address of the last relay, not the real user. Monitoring tools see a connection to a Tor relay but not the real destination or content.

Organisations often block or alert on Tor use, because it hides activity and is linked to evasion.

Peer to peer

Peer to peer (P2P) applications connect users directly to many other users. Traffic is spread across many addresses, can use changing ports and may be encrypted. It is harder to profile and can be used to move files or malware outside normal controls.

Load balancing

A load balancer spreads requests across several servers. Logs on one server show only part of the traffic, so an analyst must collect logs from all the servers to see a full attack. The load balancer may also replace the client address, so the real client address may only appear in a header the balancer adds.