NetFort Advertising

Announcing NetFort LANGuardian 14.4

Span port monitoring with NetFort

LANGuardian 14.4

NetFort are delighted to announce the availability of the latest major LANGuardian release, V14.4. It includes a number of major enhancements including GeoIP traffic reporting, improvements to the alerting engine and the ability to capture network traffic and generate a PCAP via any LANGuardian sensor on the network.

The main themes of this release are to improve traffic analysis, better alerting and to enhance the product so that it is better able to address compliance standards such as a CSC and GDPR. LANGuardian 14.4 includes:

  • New GeoIP filtering and displays.
  • New MetaData alerting GUI and rules support.
  • New user credentials from SMB sessions.
  • New Windows Services (DCERPC) decoder.
  • New full packet capture mechanism to save PCAPs from any LANGuardian sensor.
  • Improved accuracy of Google QUIC fingerprinting.
  • New PDF format option for scheduled reports.

New GeoIP filtering and displays

GeoIP is a feature where IP addresses are automatically matched with the country where they are registered. This is very useful if you want to track which countries are connecting to your network or what countries clients on your network are connecting to. Use this for improving your network security or to meet data export compliance regulations, such as GDPR.

We have included two new reports which can be found under the Traffic Analysis report category.

  • Top Countries by Client Location. This report shows the total bandwidth, displayed by the country location of the client.
  • Top Countries by Server Location. This report shows the total bandwidth, displayed by the country location of the server.

The image below shows an example of the report output.

Top Countries by Server Location

New MetaData alerting GUI and rules support

We regularly host customer days where users of our products can review our roadmap or try out beta versions of our software. One of the most common recent requests was a need for better alerting. Customers want an easy way to configure alerts so that they are automatically notified of security or operational events that matter to them.

LANGuardian 14.4 has an updated metaData alerting GUI and rules support, to alert on a wide range of conditions and events that LANGuardian monitors for, such as authorized applications, unknown DNS servers, inter-subnet access attempts and much more. Use this to implement network usage policy alerting for security and compliance. This is a upgrade on the previous version and further enhancements are planned in the next LANGuardian version.

The image below shows an example of how an alert is configured. This alert will trigger if any user deletes a file called budget2018.xlsx off the network.

network traffic metadata rule

New user credentials from SMB sessions

One of the unique selling points of LANGuardian is its ability to associate network activity with actual usernames. It does this by working out what users are assigned what IP addresses on the network. However, it is possible to logon to the network with one username and then use another username to connect to a Windows file share.

LANGuardian 14.4 can now passively capture what usernames and being used to connect to Windows files shares. This is very useful for reporting on what users are connecting to file shares using administrator accounts. It is also very useful when it comes to compliance standards such as GDPR where you may have to identify sharing of credentials to comply with Identity and Access Management (IAM).

The following image shows an example of domain user association with network file share activity. The user logged onto the workstation that accessed the Profit & Loss file was darragh.delaney

Domain user accessing file

The next image shows an example of the new passive username capture from SMB sessions. The actual user that was used to connect to the file server was darragh.

network user accessing SMB file share

Windows Services (DCERPC) decoder

New New DCE/RPC, short for “Distributed Computing Environment / Remote Procedure Calls”, is the remote procedure call system developed for the Distributed Computing Environment (DCE). This system allows programmers to write distributed software as if it were all working on the same computer, without having to worry about the underlying network code.

A lot of Windows applications use DCERPC to communicate between clients and servers. Examples of this would be network based printing or some Microsoft Exchange services. Previous versions of LANGuardian were able to detect DCERPC but could not drilldown to see what applications were in use. LANGuardian 14.4 now includes a DCERPC decoder so you can drilldown and see what applications are in use.

The screenshot below shows an example of the drilldown. Here we can see how DCERPC is being used mostly for printing and Exchange on my network.

Distributed Computing Environment / Remote Procedure Calls

New full packet capture mechanism

We introduced a full packet capture feature in LANGuardian last year. Customers wanted the ability to capture unprocessed network traffic so that they could take a look at it outside of LANGuardian. The first version only allowed you to take packet captures off local network interface cards.

LANGuardian 14.4 now allows you to save PCAPs from any LANGuardian sensor on your network from a centralized GUI. Leverage your LANGuardian installation to get complete coverage for troubleshooting or forensics. The image below shows the packet capture option in use. Clicking on the network interface dropdown now allows you to select any sensor.

Packet capture

Improved accuracy of Google QUIC fingerprinting

QUIC (Quick UDP Internet Connections, pronounced quick) is a transport layer network protocol designed by Jim Roskind at Google. The most common use of QUIC today is for streaming YouTube videos. If you use a Chrome browser then data associated with your YouTube activity uses the QUIC protocol.

LANGuardian 14.4 includes improved detection capabilities for this protocol. The screenshot below shows a typical drilldown. Majority of traffic will be associated with YouTube but you will see QUIC associated with other Google services.

Google QUIC Protocol

New PDF format option for scheduled reports

Automated email reports are popular with our customers. Many will choose to get reports like Top Network Events, Top Users or Top Applications delivered to their mailboxes every day. For some time these reports were delivered in HTML format. LANGuardian 14.4 now includes a new option where you can get your reports delivered as PDF attachments.

PDF email attachments

Video: A quick tour of the new features in LANGuardian 14.4

You can download a 30 day trial of LANGuardian from here.