Enterprise Network Planning

[zanycat]

Attempting to find a tool, that will allow for enterprise network planning.

For example if my client blocks port X, what systems or software on the network would be affected.

 

[thecoldone06]

I've never seen such a tool. I've always had to research each application for ports it uses and poke holes through the firewall. If you find something, please let us know.

 

[zanycat]

It's been a difficult hunt. Still looking though, since the company runs so many different applications, many developed in-house. With security concerns reaching epic levels (finally), management is looking for a tool to help sort out some of these issues as they fortify security. So instead of shutting down port X or disabling service X and waiting for a customer to screw that they are down. We want to be proactive with notification and resolving issues, before they are locked down

 

[DarDar]

Could you use something like wireshark to scan for port traffic? Or even the simple netstat command in windows to see what connections are open?

A nice tool is also currports from nirsoft which will show open apps and the ports they are using

 

[thecoldone06]

Could you use something like wireshark to scan for port traffic? Or even the simple netstat command in windows to see what connections are open?

A nice tool is also currports from nirsoft which will show open apps and the ports they are using

That's probably your best bet for finding the port information your looking for.

 

[zanycat]

True, I thought of wireshark, but need to do more than just ports.

Trying to find a true network modeling tool, that will help with planning changes to the network.

So if I had to reconfigure a router or a IDS, I would want to know what systems in the enclave that it would affect.

 

[thecoldone06]

Sounds more like to me you need a network engineer. I don't think any one piece of software is going to give you what you want. If it did, I imagine it would be mighty expensive.

 

[zanycat]

Very true, I have not been able to find a single piece of software, nor a suite of software that will do this. As far as a network engineer, well each program has their own engineer, and getting them all in a room or to sign off on security changes, is slow. So the attempt was to speed up the process, of course there's always the fun standby method, just shut it off and see who screams.

 

[thecoldone06]

of course there's always the fun standby method, just shut it off and see who screams.

It is the most entertaining method?

 

[DarDar]

Have a look at these too:
http://www.spiceworks.com/
or
http://community.zenoss.org/docs/DOC-2614

 

[basic]

Some of what I say may have already been said but, in my experience, I have often found that changes to software or software baseline results in the majority of unexpected issues with security. While a modeling program like that may help, especially with planning out your network layout, I'm not so sure it would really help much with security. If your issues are port specific, I know that some security software have learning modes that can analyze port traffic and lock down ports based on its analysis. If any changes occur to the software, you can just re-enable the learning mode.

I think the most surefire way to alleviate some of the issues is to test proposed changes to software in a mini, non-live environment before making it go live. This, of course, would have to be coupled with documented test procedures.

 

[ATSCF]

Spiceworks won't do the job but a great free app that I use. Doesn't the firewall log traffic going out?