Security Policies and Procedures · Topic 5 of 7
Network and Server Profiling
Build network profiles from throughput, session duration, ports and critical asset address space, and server profiles from ports, users, processes, tasks.
- 5 min
- A profile is a baseline of normal behaviour.
- Network profiling uses throughput, session duration, ports used and critical asset address space.
- Server profiling uses listening ports, users and service accounts, processes, tasks and applications.
What it is
Profiling records what normal looks like for a network or a server, so that abnormal activity stands out.
A profile is a baseline. Without one, a large transfer or a new open port is just a number, and with one it can be judged as normal or suspicious.
Network profiles describe traffic, and server profiles describe what runs on one machine.
How it works
Pick a few stable measurements, record them over time, and compare later activity with them.
Network profiling elements
| Element | What it measures | Why it matters |
|---|---|---|
| Total throughput | The amount of data crossing a link over time | A sudden rise may mean a flood or data theft, and a drop may mean an outage |
| Session duration | How long conversations last | Very long sessions can mean a hidden channel, and many very short ones can mean scanning |
| Ports used | The ports and protocols seen in traffic | A new port, or a service on an unusual port, can show an unapproved service or malware |
| Critical asset address space | The address ranges of the most important systems | Lets you watch traffic to and from the assets that matter most |
Total throughput is usually measured in bits per second or bytes per hour, and is best compared by time of day. A network has busy and quiet periods, so compare Monday morning with Monday morning.
Session duration looks at how long each connection lasts. A web browsing session is usually short. A session that lasts for hours between a server and an unfamiliar address stands out.
Ports used shows which services the network really uses. A profile might list the top ports and the share of traffic each carries.
Critical asset address space is the list of subnets that hold key assets, such as payment servers or databases. You can then write alerts such as any connection from the guest network to the critical range. Traffic to those addresses from unexpected places deserves attention.
Network profile data usually comes from NetFlow and similar records, since they hold addresses, ports, counts and durations.
Server profiling elements
| Element | What it records | A sign of trouble |
|---|---|---|
| Listening ports | Which ports accept connections | A new listener that is not part of the service |
| Logged in users and service accounts | Who is signed in, and which accounts run services | A user at an odd hour, or a service account used interactively |
| Running processes | Which programs are running | An unknown process or one running from a temporary folder |
| Running tasks | Scheduled jobs and startup tasks | A new task that starts a script |
| Applications | The software installed and in use | Unapproved or outdated software |
$ ss -tulnp
$ who
$ ps aux
$ crontab -l
$ dpkg -lOn Linux, these commands show listening ports, logged in users, processes, scheduled jobs for the current user and installed packages on Debian based systems. On Windows, netstat -ano, query user, tasklist, schtasks /query and the installed programs list give the same information.
A service account is an account used by a program, not by a person. It often has broad rights and a password that rarely changes, so attackers value it. An interactive login by a service account is unusual.
Using profiles
- Record the profile during normal operation and keep it updated as the environment changes.
- Compare current data with the profile on a schedule, or let a tool do it.
- Investigate each difference. It may be a legitimate change, such as a new application.
- Update the profile after a verified change.
For example, a web server profile lists ports 80 and 443 only. A later check shows a new listener on port 4444, and a process running from a temporary folder. The profile makes the change obvious, and it points to a backdoor.
What to remember for the exam
Seven facts cover most questions on this topic.
- A profile is a baseline of normal behaviour.
- Network profiling uses throughput, session duration, ports used and critical asset address space.
- Server profiling uses listening ports, users and service accounts, processes, tasks and applications.
- A new listening port on a server is a warning sign.
- Compare like with like, such as the same time of day.
- Critical asset address space lets you watch traffic to the most important systems.
- Update the profile after a legitimate change.
Throughput, duration, ports and critical addresses describe the network. Ports, users, processes, tasks and apps describe a server.
Common mistakes
These four errors appear often.
Profiling for too short a time. A baseline needs to cover busy and quiet periods.
Never updating the profile. Legitimate change then looks like an attack.
Ignoring service accounts. They are powerful and often poorly watched.
Comparing different time periods. Compare similar days and times.
A difference from the profile is a reason to look, and it is not proof of an attack.
Check yourself
Work through these three questions.
What are the four elements of a network profile?
Total throughput, session duration, ports used and critical asset address space.
What would a new listening port on a web server suggest?
It suggests an unapproved service or a backdoor, since the profile lists only the expected ports.
Why compare traffic with the same time of day?
Networks have busy and quiet periods, so only a like for like comparison shows a real change.
Topic 5 of 7 in Security Policies and Procedures
Test yourself on Security Policies and Procedures
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.