Chapter_9_LAN Communication Profiler (LAN CP)

Question 1

What is LAN CP?

Answer 1

• Network Communications Baselining Engine
• The LAN Communication Profiler tracks and analyzes communication patterns among network devices, protocols used and message types (e.g. read andwrite commands)
• Used to baseline the network communications within a LAN environment

Question 2

What are the 2 LAN CP operating modes?

Answer 2

Learning

-The initial state of the Profile upon creation
-Automatically learns all communications seen by the sensor to create abaseline
-Should stay in learning mode for 2-3 weeks (depending on networkcomplexity)
#Detection
-Can be set after the Profile has learned the network behaviorAll communications deviating from the baseline generate an Alert

Question 3

What are some best practices for LAN CP?

Answer 3

• Make sure all malicious/abnormal rules inside the profile areremoved
• Keep the scope of rules to low granularity (entire subnetworks)
• Used named ports/IP ranges
• Use description field for documentation

Question 4

When do you switch to detecting mode?

Answer 4

Done after concluding the learning and tuning phase Time depends on the complexity of the network Average period is around 2-3 weeks