Network Protocols Glossary
What is a network protocol? Protocols are the rules of the road for how data exists and moves on the network. They allow many different systems and computers to communicate.
Protocols we decode
ExtraHop decodes the following enterprise protocols with real-time fluency at the application layer. Protocol modules offer varying levels of analysis, starting with L7 classification, and Application Inspection Triggers allow you to create a custom metric.
AAA: Diameter
AAA: RADIUS
ActiveMQ
AJP
ARP
BitTorrent
CFP
CIFS
Citrix ICA*
CoAP
Cryptocurency mining protocols
Database: DB2
Database: Informix
Database: Microsoft SQL
Database: MongoDB
Database: MySQL
Database: Oracle
Database: Postgres
Database: Redis
Database: Riak
Database: Sybase
Database: Sybase IQ
DHCP
DICOM*
DNS
DSCP
FIX*
FTP
GENEVE
GRE
HL7 (including FHIR and ICD-0-10)*
HTTP-AMF
HTTP/S
IBM MQ
ICMP
ICMP6
IEEE 802.1X
IIOP
IKE
IMAP
IPFIX
IPSEC
IPX
IRC
ISAKMP
iSCSI
Java RMI
Kerberos
L2TP
LACP
LDAP
LLDP
LLMNR
Memcache
Microsoft NMF
Modbus
MPLS
MS-RPC
MSMQ
Netbios
NetFlow and SFlow
NFS
NTLM
NTP
NVGRE
OpenVPN
PCoIP
POP3
PPTP
QUIC and GQUIC
RDP
RFB (VNC)
RSH
Skinny (SCCP)
SMPP*
SMTP
SNMP
SOCKS
Splunk
SSH
SSL
STP
Syslog
TCP
Telnet
TFTP
TRILL
VNC
VoIP: RTCP*
VoIP: RTCP XR*
VoIP: RTP*
VoIP: SIP*
VXLAN
Websocket
Windows Update Delivery Optimization
WireGuard
WMI
WSMAN
*Not included in Reveal(x) 360 base license
ExtraHop Technology
Technical deep dive into network detection and response
Of particular interest to SecOps analysts, Reveal(x) 360 analyzes application-layer metadata for databases, Active Directory, web, SSL, and storage systems:
Databases
RDBMSs: Oracle, Microsoft SQL Server, MySQL, PostgreSQL, Informix, Sybase, and DB2. NoSQL databases: MongoDB, Memcached, Redis, Riak. Metadata extracted include transaction timing, table/user access patterns, query errors, SQL queries and responses, and system-level commands.
Identity and Access Management
Active Directory visibility, including NTLM, Kerberos, LDAP, MSRPC, WINRM, SMBv3, and DNS monitoring for privileged identities and service accounts allows you to improve detection and facilitate audits. Reveal(x) extracts metadata including user/computer account activity, invalid or expired passwords, new privileged access, privileged access errors, DNS SRV lookups, LDAP binds, plain-text HTTP authentications, unknown SPNs, and forged Kerberos ticket detection.
Web Transactions
Full HTTP payload analysis of user activity, SOAP/XML, JSON, Javascript, APIs, etc. Extracted metadata includes URI, query parameters, host headers, and user agent, among others.
Storage
Metadata extraction for all NAS and SAN transactions (iSCSI, NFS, and CIFS) enables machine learning detections based on actual file details and equips security analysts to track file access patterns and detect ransomware activity by examining file extensions and WRITE operations.