Ethical Hacking, Penetration Testing and IT-Forensics - Logs and Log Handling

Vocabulary terms and definitions related to log management, network evidence sources, and time synchronization in the context of ethical hacking and IT forensics.

NTP

Network Time Protocol; used to synchronize time between systems, which is critical for accurate evidence timestamps.

Stratum 0

The top level of the NTP hierarchy, also called reference clocks; these often run atomic clocks or receive GPS time.

ntp.hv.se

A stratum $2$ time server that receives its time from Swedish national time servers (stratum $1$).

SNMP

Simple Network Management Protocol; used to collect information from agents, set configuration on equipment, or receive traps when events occur.

SNMP Agent

The software running on a managed system, such as a router or switch, that communicates with a Network Management System.

Network Management System (NMS)

A system running on a server that gathers data from SNMP agents and displays it to the user.

SNMP v1

The first version of SNMP characterized by very low security and cleartext authentication.

SNMP v2c

An SNMP version with low security that utilizes $64$-bit counters to handle higher volumes of traffic.

SNMP v3

The most complex SNMP version which utilizes TLS encrypted transport for increased security.

UDP Port 161

The standard port used for SNMP communication.

Netflow

A Cisco-originated protocol used to count and export flow records to a collector for traffic analysis.

Flow

A sequence of packets sharing the same ingress interface, Source IP, Destination IP, IP protocol, Source port, Destination port, and Type of service.

IPFIX

The IETF standardized version of flow protocol, based on Netflow version $9$.

sFlow

A technology that sends headers from sampled packets and traffic counters to a collector for traffic type statistics, without showing full packet content.

SPAN/RMON

Technologies used for port mirroring, copying all traffic from one switch port to another for delivery to systems like an IDS.

Lawful Intercept

A specific monitoring feature found in many ISP or carrier switches and routers.

Normalization

The process of rewriting different log formats (such as timestamps and addresses) into a common format to allow for accurate correlation and comparison.

Splunk

A well-known commercial system used for log analysis and correlation.

ELK

An Open Source alternative for log analysis consisting of Elasticsearch, Logstash, and Kibana.