Sandstorm Enterprises® : NetIntercept® Software Specs

Significant Events tab on Session List shows Email, Web pages and images found in the set of connections
Connection View pane below Session List displays selected connection
Traffic map on Session List provides a clickable time-domain view of the selected sessions with sophisticated filtering
Drill-down on individual connections

Connection display includes summary and DNS information
Raw data stream, with or without packet headers
Recognition history tree of connection's parse
Selection criteria extracted from connection, by group
Data objects extracted from stream
Email headers extracted from stream
Packet view of sessionized stream using integrated LANWatch viewer
Right-Click context-sensitive menus on Summary tab items
Buttons to move to next or previous connection in Session List

View alert conditions detected during parse with drill-down to connection drill-down

By class and type of alert
Applicable to connections selected by current Netmask
Applicable to a particular network host
Occuring during a user specified time range

Save selection queries
Display image data objects found in captured sessions, with session drill-down

Images selected according to origin host
Images obtained from connections selected by current Netmask
Images occurring during a particular time range
Extract Event List values to CSV file
Save captured images to files in various formats

Analysis and rendition of linkage between FTP Control and Data connections
Analysis and rendition of linkage between IRC and DCC file transfer
Display reconstructed web pages from captured sessions

Will not execute or display active content
View linkage information extracted from HTML files
Components assembled from multiple TCP/HTTP transfer operations
Associations tab has context-sensitive menus to access Session List, Connection and Image views

Graphical display of client-server interactions between hosts on the monitored network

Viewpoint selectable via host name or IP addresses
Viewpoint selected by current Netmask
Viewpoint sorted according to number of connections, packets or bytes
Drill-down to all connections between a pair of hosts for export or further analysis

Hierarchical display of LDAP sessions
Graphical display of X.509 security certificates
Analysis/rendition of linkage between SIP and RTP (VoIP) connections
Host Connectivity map can be saved to file in various image formats
Traffic Map tab provides a clickable time-domain view of some or all analyzed sessions with sophisticated filtering and navigation
Audio tab lets you review and play captured audio files on the system console, or export them to a remote machine for playback there.
Manage on-disk archive of results databases

Bookmark connections, images and webpages

Includes user-supplied notes
Saved in results database for future use
Bookmark list may be transferred, including file objects and an HTML report linking to them
Drag and drop NetIntercept bookmarks into the Investigator's Notebook

Controls Report Generation Subsystem

Create, View and Delete reports in a database-related context
Simplified selection of report parameters
Simplified use of customized templates

Export data via secure file transfer with SCP

Captured network traffic, pre- or post-analysis
Results database
Individual sessions chosen via search criteria
Reports
Extracted files from web, email or file transfer traffic

Enhanced "Copy to Clipboard" support

Allows customers to copy and paste NI windows and panes onto the clipboard and into applications on their local system
Copy images, list views, host map, traffic map, labels and table rows

Data Capture Subsystem

Seamless Data Capture from Monitoring Interface
Capture Rate

300 mbits/sec 10-second average in NI-DR3010 and NI-DR1510 configurations

Recommended for Rapid Event Analysis^™ at full data capture rate
Keyword search all traffic where 24-hour average flow is 40 megabits second or less

120 mbits/sec 10-second average in NI-D810 configuration

Recommended for Rapid Event Analysis^™ at full data capture rate
Keyword search all traffic where 24-hour average flow is 25 megabits second or less

60 mbits/sec 5-minute average in NI-D410 configuration

Recommended for Rapid Event Analysis^™ at full data capture rate
Keyword search all traffic where 24-hour average flow is 5 megabits per second or less

40 mbits/sec 5-minute average in NI-2L60 configuration

Recommended for Rapid Event Analysis^™ at full data capture rate
Keyword search all traffic where 24-hour average flow is 5 megabits per second or less

Traffic Filtering

Capture all traffic (default)
User-specified filtering

Unix "libpcap" compatible

Completely Passive - No Transmissions on Monitored Interface

When properly configured, undetectable by "sniffer location" techniques

Uses Standard "tcpdump" File Format

Data captured on other machines may be transferred to NI for analysis
Archives and intermediate files generated by NI may be analyzed by non-Sandstorm tools

Data Archive Subsystem

Archives Original Traffic Capture Files

Fundamental disk-resident lifetime depends on

Storage option selected
Percentage load on monitored network
Can be tuned to suit particular situations

Old traffic capture files and other system output can be securely copied

To other nodes reachable from the control network interface
To read-only CDRW storage media

Manages Secure Export of Captured Data Files

Capture (Raw) data files
Sorted Traffic
Result Sets
File objects
Reports
Other Files

Analysis Subsystem

Analyzes Traffic Captured by NI, or Imported from Another Capture System

Importable file formats include tcpdump, LANWatch, Snoop, Sniffer, NetXRay and NetMon
Handles both DIX and 802.3 Ethernet encapsulations
Handles traffic using 802.1q VLAN tagging
Imports 802.11 traffic captured by Kismet (libpcap Data Link Type 105)
Sessionizes ARP, ICMP PPPoE, PPP and IPv6 streams containing ICMPv6, TCP and UDP
Sessionized streams stored in container files for faster I/O
Export of standard tcpdump format via GUI

Parses Data at the Stream/Object Level

SSL session decryption/analysis via import of SSL server keys
SSH session decryption/analysis via key escrow available with optional server software
Recognizes common multimedia formats: AVI, Flash, WAV, TIFF
Parses VNC, BGP, Gnutella, YMSG, BZIP2, RADIUS, SMB
Parses PostScript, RTF, terminal traffic, lpr, Java, RTSP, WinZip
Recognizes common Microsoft file types: Word, PowerPoint, Excel, EXE

Search text recovered from Word, Excel, and PowerPoint

Parses chat protocols IRC, AOL_IM, Yahoo Messenger, Microsoft Messenger and Jabber (GoogleTalk)
Links related TCP connections together for HTTP, FTP, IRC and AOL_IM protocols
Basic VoIP detection via parse of SIP, RTP and RTCP protocols
Recognizes Unix "remote" commands: rexec, rlogin, and rsh
TNEF parser module recognizes/saves Transport-Neutral Encapsulation Format.
VCF parser module recognizes and harvests from VCard objects.
PGPFile parser module recognizes/saves PGP-encrypted files.
Session Description Protocol (SDP) parser links VoIP control and data streams.
Recognition of IMAP and NetBIOS Session protocols.
TCP parse module handles ahead-of-sequence data

Broad Range of Protocol Parsing Modules

Oriented towards "network boundary" traffic
Can handle multiple layers of analysis

text inside uuencode inside MIME inside email
http inside ssl

Heuristic Application Data Stream Recognizer

Find protocols being used on non-standard ports
Find protocols being used inside decrypted streams

Extensive Protocol Error and Security Violation Detection Capability

Specific Alerts that are irrelevant to a site/mission can be disabled

Uses a Private Domain Name Translation Database

Basic database generated from monitored net traffic
May be supplemented by user-supplied host files

All Results Written to SQL Database for Easy Lookup

Via graphical user interface
Via report generator
Via direct SQL access

Netmask Management Interface

Add, delete and modify netmasks directly from the NetIntercept GUI
Netmasking capabilities allow you to mask on connection endpoints

Source
Destination
Both, either, or neither

Parse Operations Controllable on a Per-module Basis

When to save the extracted data object to disk
Whether to save the current object or a parent data stream

For example text extracted from a Word file vs. the original Word format

Search strings for "Known Content" recognition
Whether or not to pass extracted data streams to child parsers

Advanced Content Search Modules

FINDPHRASE module is capable of searching for up to 8 phrases
FINDWORD module is capable of simultaneously searching up to 200 strings
Support for 8-bit Universal search strings

Allows users to search for non-ASCII strings using FINDWORD, FINDPHRASE
Full UTF-8 support, with conversion from many character sets
Integrated with Microsoft Word, Microsoft Powerpoint, Microsoft Excel, RTF and Plain Text parse modules

Search of text content not otherwise recognized by a content parse module
FINDBYTES module to search for hex sequences in file objects

Report Generation Subsystem

Generates Reports from User-customizable Templates

Templates provided for Text and HTML formats
Templates are editable using a variety of different tools

Including WSYWIG tools on other systems

All reports display IPv6 addresses where found
Reports can be used in the following ways

Viewed through the graphical user interface
(if hardware option is selected)
Saved to read-only CDRW media
Transferred elsewhere via "control" network
Generated automatically via automated operations

Six Overview Reports Available

Observed network configuration (Discovery)
Most active by various different measures (Top N)
Network activity for a named user
Network activity summary for a given IP address or hostname
Network activity detail for a given IP address or hostname
Network activity detail for a given MAC (hardware) address
Parse tree statistics with module relationships (parse-stats)

One "Graph" Report Available

Parse graph for the current database

Thirteen Database Tabulation Reports Available

Error or alarm conditions
Usernames and associated cleartext passwords
Usernames only
Network bandwidth usage by host
Electronic mail recipients, subjects by sender
Web activity by host and requested URI, grouped by type of activity
Domain Name System lookup history
Domain Name System non-address namespace
Address Resolution Protocol namespace
NetBIOS Nameservice Protocol namespace
Services requested by client system
Connections between machines whose start/end was not captured in the database
Distinct file-like objects captured, including IMT and MD5

Investigator's Notebook

Take notes about your investigation of network traffic
Notebook entries can be created manually or automatically generated by NetIntercept
Each entry may have multiple notes
Each notebook may have multiple users
Time stamped for "Chain of Custody"

Automated Operations

Automatically Control NetIntercept

Build scripts for unattended NetIntercept operation

Select data for analysis, export or long-term retention (immortalization)
Sessionize and parse immortalized data
Generate reports on results databases
Export raw traffic, sessionized traffic, results databases or reports via Secure Copy protocol
Delete immortalized data, sessionized data, results databases and reports
Mail status messages
Create entries in the Investigator's Notebook

Schedule one-time or repeated execution of scripts through the GUI
Scripts may be configured to wait for busy resources
Initiate scripts on receipt of SNMP traps on the control interface
Graphical interface allows import of trap definitions from a MIB
Specify NetIntercept response actions

Audit Logging

All NI components log important user actions for later audit

System Software

FreeBSD 7.1-RELEASE Kernel

Minimal Set of Unix Utilities
High-security Network Configuration on Interface #0

SSH for remote access
SCP for file copy

The Capture Interface is Configured and Locked Down for Capture Only
Bridge creates two or more IEEE 802 networks that use the same framing networks

Printer Support

USB Port for Printer Provided

Standard OS drivers included
User configurable

MySQL Database Server

SQL Database for Storage and Retrieval of Parse Results

ISAM tables for fast, efficient access

Configured for High Security

No remote access
Administrator has full access
User has limited access

Setup Process

Initial Installation

Configure IP address/netmask/gateway for control interface

Monitoring interface is silent

Configure DNS options

Name server accessible via interface #0

SNMP support for status monitoring

Disabled by default
Heartbeat
Free disk space
Other standard Unix MIB variables

Generate initial private-key encryption key on the license management device
Enter passwords for NetIntercept user accounts
Configure "Monitored" network

Distinguish our network from outside networks
Identify local subnets by setting up the "netmask" database table

Initialize new capture disk
Certify installation

Initial Default Configuration Is Set Up by Sandstorm

Based on information obtained during the sales cycle

NI Setup Process Can Be Re-run

After the machine has been moved
When the local network environment is changed

Read the NetIntercept Whitepaper

Request a NetIntercept Demonstration

Sandstorm's Products

Order / Get a Quote

Sandstorm Enterprises develops

tools with sharp edges^®

for information security professionals.

Site materials © 1998 - 2010 Sandstorm Enterprises, Inc. The Sandstorm logo®, LANWatch®, NetIntercept®, PhoneSweep®, Sandtrap®, TCP.demux™, Single Call Detect™, Tools with sharp edges®, Rapid Event Analysis™, and Sandstorm Enterprises® are all trademarks or registered trademarks of Sandstorm Enterprises, Inc.