Overview

With the rapidly increasing evolution of malware, spyware, viruses, APTs and other hacking techniques, the traditional security setup of firewall plus antivirus is no longer sufficient. The firewalls of today (including their derivatives: IDSs and IPSs) are direct descendants of signature-based detection technology from the 90s. These network security devices operate by comparing incoming communications against the signatures of known threats; they can only catch threats for which they have signatures. When malware numbers in the millions and new variants pop up every day, users are left vulnerable. When these vulnerabilities lead to a breach, packet capture is the only thing that provides the when, what and how.

It is critical to secure IT infrastructure. Organizations that deploy packet capture gain visibility into their network activity, a key component of cybersecurity. This visibility provides the necessary operational intelligence for quickly and thoroughly addressing network incidents, as well as ascertaining the actual threat environment. With the full packet capture history in hand, investigators can trace back and reconstruct every single cyber-event as it unfolded, rather than trying to cobble together evidence and a rough timeline based on incomplete, fragmented data.

Capture Every Packet, Every Time

IPCopper’s full packet capture appliances (aka packet sniffers) capture and store Ethernet/IP activity in full, ensuring that when you need to know what happened on your network, the data is there. This type of full packet capture enables effective incident response and comprehensive network forensics investigations into security breaches, hack attacks and other network incidents based on complete and accurate packet capture data, both current and historical.

IPCopper network devices are standalone, fully automatic, Ethernet/IP, high memory capacity gigabit and 10G packet capture appliances. Truly no configuration is required — simply connect power and Ethernet cables and the unit is ready to go. Deploy the unit inline (aka, pass-through; the unit automatically acts as its own network tap) or on a SPAN port. When connected as pass-through, IPCopper packet capture appliances introduce less than 1 ms (<0.001 sec) of latency and will not affect network flow or topology.

Integral data security features keep captured data private. Operating under a cloak of electronic invisibility (no IP or MAC address), IPCopper packet capture appliances cannot be addressed nor detected like traditional network devices. For additional security, all captured data is encrypted using a 20,000 bit external key.

DIY Packet Capture vs IPCopper

Although many tools and software are available to do DIY packet capture, there are several issues when building a DIY packet capture appliance:

1. Security. Management can be the weak point of any system – something not to be taken lightly considering the data captured and recorded. Any packet capture solution should include robust and multiple security controls.
2. Data Integrity. Regardless of whether the appliance uses Windows or Linux, the packet capture data would be stored in files, with the appliance relying on the OS to do data processing. Some data would inevitably fall through the cracks, giving you a capture rate of less than 100%. There is also the further issue of potential corruption.
3. Authentication. It would be difficult, if not impossible to verify whether the data stored on a do-it-yourself device is authentic.
4. Speed. The lowest end IPCopper appliance can operate at a sustained speed of 400 Mbps, while the fastest can do 5 Gbps sustained at six million packets per second. Appliances based on Windows or Linux would require expensive, specialized hardware to achieve anything beyond 10 Mbps.
5. Timestamping. Linux, FreeBSD and Windows based systems skew timestamps by as much as 50ms or more due to how the drivers are implemented, memory allocation and plain old fashioned load. Multiple components vie for processor time, which can lead towards errors in timestamping and ordering of the packets. IPCopper's appliance design is unique in the that it is able to deliver consistent and always accurate timestamping up to the maximum specified load.
6. Time and Cost.

IPCopper packet capture appliances are stealthy and work out of the box. The recorded data cannot be altered or modified and is encrypted prior to storage. Their remote access capabilities are encrypted and user-controlled by means of a physical switch on the front panel of the device.

Capabilities

IPCopper packet capture appliances record web browsing sessions, emails, IM chats, FTP sessions and all other Ethernet-based transmissions, communications and commands in full, capturing both packet headers and payloads. They are ideal for:

• Detecting intrusions, unauthorized access and other threats to your data and network structure.
• Intercepting and recording IP-based communications from unsecured or unauthorized software and hardware (such as keyloggers, microphones, cameras, wifi and surveillance equipment).
• Gathering detailed evidence of cyber-attacks, corporate espionage, data leakage and internal misuse.
• Making carbon copies of e-mails, IM chats and other electronic communications.
• Logging access and transmissions to and from data servers, file servers, credit card servers or other databases.
• Monitoring the internet use and network activities of employees.
• Identifying and troubleshooting network problems.
• Benchmarking servers and networking equipment.
• Diagnosing virus, spyware and malware infestations.
• Facilitating thorough forensic analysis and quick incident response.
• Ascertaining the extent of compromised data and liability in the case of a breach.
• Recording VoIP calls and SIP sessions.

Downloading the captured packets from IPCopper is easy, fast and convenient: simply use the included command-line utility and input the desired date and time range on your computer. You will immediately receive a PCAP file of the information requested, which you can use with your favorite packet analysis tools.

IPCopper models

All current IPCopper packet capture appliances feature the following:

• Electronically invisible — no IP or MAC address
• Autonomous operation, no configuration required
• Jumbo frames support, up to 9KB
• Flow control
• Tamperproof case

Custom Solutions

Many, when referring to custom solutions or customizations, mean tweaking an existing product, implying that a custom solution is merely an offshoot of a standard product. While you may only need the addition of a couple of ports of a certain type to a short run of one of our standard models (which we can do quickly and inexpensively), we at IPCopper offer a lot more. When we refer to a custom solution, we mean a solution that meets the needs of our customer, which may or may not be based on one of our standard models. We can build the entire system from the ground up based on what the customer wants and needs using our accumulated expertise in software, hardware and data processing.

For example, if a company suspects an insider of unauthorized access to or theft of the company’s sensitive data, it may be advisable not only to deploy packet capture but also install software on the suspect’s computer to record keystrokes and monitor other activities. Solutions could also entail employing a decoy mimicking a server containing sensitive information so that the suspect, while thinking he/she is grabbing data from the real thing, is actually working within a controlled environment.

When a sophisticated insider is suspected, perhaps technology-saavy or even a member of the IT staff, it may be difficult to place a standard packet capture appliance without alerting the suspected individual or individuals. In these situations, IPCopper can help you get the job done discreetly, without tipping off any suspects by providing a packet capture solution disguised as something else. This chameleon packet capture appliance may also incorporate other features, such as GPS or built in power supplies, so it can operate autonomously from the electrical grid. [ read more ]

The management utility may also be customized for integration in your particular Linux environment. [ read more ]

Please contact us to discuss your data recording and network monitoring needs and how IPCopper can meet them.