Chapter 12 Monitoring Data and Metadata

_______________ can help you understand network usage, the protocols being used, users who consume a lot of bandwidth, and who is communicating on the network

bandwidth monitors

Name the type of metadata

\
All of these produce metadata that can be used to identify people, places, times, and even deleted data. Pictures can be timestamped and geolocation stamped. Much of this metadata also reveals origination of the data and the sender.

mobile metadata

Name the type of metadata

\
cookies, browser history, and cached pages. 

web metadata

Name the type of metadata

\
Parts of the headers can be spoofed giving investigators false information. However, there are security devices that put X-headers throughout an email's header. These provide the originating email account and IP address not the spoofed one.

email metadata

Thisis a feature on Cisco routers. It works at layers 2 – 4. It can examine each data flow that comes through the network or it can be set to sample sessions at certain intervals.

NetFlow

________ s a packet sampling technology that works on layers 2 – 7 of the stack. It only can be used in sampling mode. This is a stateless packet sampling that provides information on various layers and does it quickly and efficiently.

sFlow

_____directly integrates data that normally goes to Syslog or SNMP

IPfix