NSM Chapter 4
Session data - correct answer Session data is the summary of the communication between two
network devices
This summary data is one of the most flexible and useful forms of NSM data
It is also known as a conversation or a flow
Session data doesn't give you the "What", but it does give you the "Who, Where and When"
It has smaller size and is much quicker to parse and analyze
Session Data - correct answer Transport Protocol
Source IP address and port
Destination IP address and port
Timestamp of when the communication began and ended
Amount of data transferred between two devices
Flow Records - correct answer A flow record is an aggregated record of packets
The aggregation can occur differently depending upon which tool is being used to generate and parse
the data
A flow record is identified based upon five attributes that make up the standard 5-tuple
Data will be appended to same flow record as long as packets matching the 5-tuple attribute values are
observed
Flow Record Types - correct answer NetFlow
IPFIX
Other Flow Types
Flow Record Termination Condition - correct answer 1. Natural Timeout:
Communication naturally ends based upon a specification of the protocol e.g. RST packets or FIN
sequences in TCP.
