Components

The dashboard continually updates the display view of the networks’ status, showing information that is of interest to the user. The Dashboard is fully configurable, allowing the user to display any or all of the elements of the LANGuardian, including: The dashboard continuously updates the display without any user action, and so is suitable for NOC style monitoring.

The Traffic Collection Engine collects both raw traffic, Cisco NetFlow and sFlow traffic, via copper or fiber sniffer ports. The support for Cisco NetFlow allows for visibility onto both local and wide area networks (WANs). The key benefit of the Traffic Collection Engine is both real time and historical visibility of network usage, with built-in drill down to enable rapid troubleshooting.

Through passive monitoring, a system administrator gains a thorough understanding of how the network is used; detects anomalies; observes trends; understands the networks’ topology; and becomes familiar with what services are available, what operating systems are in use and what vulnerabilities may be exposed on the network

At the core of LANGuardian is a central database that stores critical and useful network data including: Collecting this data at one point provides a consolidated view of network activity, enabling easier detection and troubleshooting of anomalies or suspicious network events in real-time, whilst supporting forensic analysis of previous events.

The LANGuardian has an integrated NIDS that enables real-time detection and alerting. The system utilizes a rule driven language, which combines the benefits of signature, protocol and anomaly-based inspection methods. We use several pre-processors to perform complex stateful protocol analysis and normalization, detecting anomalies.

LANGuardian can report on all attempts to connect to inappropriate websites (either directly or via a proxy), including spy-ware, pornography, or sites which are known to be associated with virus activity. All web access attempts can be logged.

When the Active Directory or Novell eDirectory module are in use, Internet activity reports can identify the originating username. Access attempts to dubious web sites are identified by checking the site name against a ‘blacklist’ database.