Analysis principle
Normal TCP-based network traffic is to establish a TCP connection first, then transmit data, and then disconnect.
However, problems such as system poisoning and configuration errors often exist in the network, resulting in one-way requests in the network, and this information will also be reflected in network traffic.
NetInside automatically discovers a large number of connection requests, but the other party does not respond, and the statistics are the number of failures.
Abnormal Behavior Discovery
The IP 172.17.254.243 sends an average of 6480 requests per hour, 3600 of which fail.
Abnormal Analysis
All abnormal behaviors will leave network traces, download the original packets of 172.17.254.243 through the system, and analyze the traffic at that time.
Through the analysis of the downloaded data packets, it was found that a large number of requests were rejected.
suggestion
Based on the abnormal hosts found by the NetInside analysis system, improve the network or device-related rules of these hosts with failed request behavior, or go deep into the host to check the process.