Detecting Anomalies

Note

This feature required Professional or Enterprise Edition

An Anomaly is a signature of abnormal activity that may indicate a security breach, or an outside entity searching for network or device vulnerabilities.

A Vulnerability is an opening that can be exploited to cause damage to a device, or to network security.

Genian NAC inspects network traffic to identify abnormalities in the network and marks endpoint devices that have Anomalies. You can configure custom Anomaly Definitions or use the seven pre-defined definitions provided by default to detect endpoint devices that are exposed to major Anomalies such as Ad hoc Networks, ARP Bombing, ARP Spoofing, MAC+IP Clones, Port Scanning and more.

• Understanding Anomaly Detection
• Pre-Requisites for Anomaly Detection
• Creating Anomaly Definition
• Detecting Anomalies
• Blocking Anomalies
• ARP Bomb
• MAC+IP Clones
• Multi-Homed / Ad hoc Network
• Port Scanning
• Rogue Gateway
• Spoofed ARP
• Unauthorized Service Request