Microsoft PowerPoint - SDN Security - Scott Hogg - 2017-06-22.pptx

Security Monitoring with SDN

• Switches often lack sufficient resources to perform
  packet/port mirroring/taps
  o Every IT silo/team wants their own tap/SPAN session (Network Packet
  Broker (NPB))


• Bi-directional packet capture is much better than NetFlow


• Dedicated copper/optical packet monitoring switches can be
  very expensive, many taps are required – no blocking ability


• Tap Aggregation is an application that is simple for a SDN
  controller and uses low-cost SDN-capable network devices


• Examples: Cisco XNC with Monitor Manager and Nexus 3000
  Tap Aggregation Switch, BigSwitch Big Tap Monitoring Fabric,
  Microsoft Distributed Ethernet Monitoring (DEMon)
  Using SDN to Create a Packet Monitoring System
  http://www.networkworld.com/article/2226003/cisco-subnet/using-sdn-to-create-a-packet-monitoring-system.html