Archive for April, 2009

childrens educational software

Thursday, April 30th, 2009

Childrens Educational Software

Writen by Jimmy Sturo

Children’s educational software is widely available in schools, and to parents who want to make their home a healthy, learning environment for their kids. Even public libraries and museums, nongovernmental organizations and children’s hospitals have this software available.

Benefits of children’s educational software

By integrating technology into the learning environment, children’s educational software can make learning highly personalized. The child can manipulate the software to fully understand the concepts being taught. They do not feel judged, even if they are slow-learners. The software can repeat information an infinite number of times without a problem.

Children’s educational software also extends curriculum choice and helps develop multiple intelligences. For a very small investment, schools and parents can exponentially extend their current information libraries for kids. There is no need to build additional infrastructure or spend money on additional books. Everything is in one software package.

Children’s educational software can o help build learning ‘communities’ that are connected either physically or virtually. Such software is typically linkable to other computers (and therefore other users). Some functionalities allow students to interact, form teams, or simple help each other out.

Buying children’s educational software

You can acquire children’s educational software either off-the-rack from software specialty stores, or through special authorized educational resellers. For use in schools and other learning institutions, the manufacturer or developer of the software usually gives licensing discounts and extra after-sales support. You can buy campus and school agreements, either open or select licences, and student and teacher licences, among many others. More often than not, manufacturers and developers of children’s educational software give low-cost, comprehensive licensing agreements for the unique needs of primary and secondary educational organizations on an annual basis. They also offer volume-licensing arrangements exclusively to educational institutions, so that these schools can take advantage of significantly lower volume-based pricing.

Educational Software provides detailed information on Educational Software, Childrens Educational Software, Free Educational Software, Educational Software Companies and more. Educational Software is affiliated with Discount Embroidery Software.

computer printers offer infinite variety but toner can put a strain on your budget

Thursday, April 30th, 2009

Computer Printers Offer Infinite Variety, But Toner Can Put a Strain on Your Budget

Writen by Chris Robertson

If you’re old enough to remember daisy wheel printers, you know just how far technology has advanced when it comes to computer printers. We’ve come a long way from the days when a daisy wheel would strike an ink ribbon and produce a letter on a page, and even from the days when a dot matrix printer would use its 24 pins to, line by line, produce a sheet of text.

Types of Printers

These days, of course, there are many different options when it comes to printers. For home use, many people continue to rely on inkjet printers, which are a relatively cost-effective way to print in both color and black and white. Other people opt for laser printers, which offer better speed and quality than inkjet printers. While they have dropped in price, color laser printers are often cost-prohibitive for home use, which is why many people choose inkjet printers for color.

Toner-based laser printers are the printers of choice for most office applications. With the increase in in-house graphic design and desktop publishing, small printing jobs can be performed more cost-effectively with a color laser printer than sending them out to be printed on an offset press.

Some offices – particularly those that wish to produce high-quality printed material – have turned to solid ink printers that use wax-based four color thermal transfer printing. Using solid ink CMYK colors mimics the effect of color separation on a printing press, which produces richer, deeper colors. Likewise, dye sublimation printers are often used for photo-quality reproductions, and are often marketed as photo printers.

Printer Manufacturers and Pricing

There are a number of first-rate printer manufacturers. Hewlett-Packard (HP), Epson, Canon, Brother, Apple, and Xerox all manufacture laser and/or inkjet printer. It’s been interesting to watch the pricing strategy of printer manufacturers, which is generally to charge a minimum for computer printers, while charging an exorbitant amount for Original Equipment Manufacturer (OEM) or brand name toner. This phenomenon is similar to the strategy employed by video game console manufacturers, where they barely recover the cost of manufacturing the console in the purchase price, but then charge dearly for the actual video games.

Avoiding Getting Gouged with OEM Toner

Although printer manufacturers would lead you to believe that brand name toner is the only toner that works in their printers, the truth is that high quality remanufactured toner or Reflexion toner works just as well. You can buy toner that is compatible with Hewlett-Packard (HP), Epson, Canon, Brother, Apple, and Xerox printers at a fraction of the price.

So, enjoy the low prices and high quality of brand name printers, but don’t get gouged by the high price of toner. Always remember that there are alternatives that work just as well!

Chris Robertson is an author of Majon International, one of the worlds MOST popular internet marketing companies on the web. Learn more about Computer Printers and Toner or Majon’s Computers directory.

microsoft great plains manufacturing or bill of materials overview for it specialist

Thursday, April 30th, 2009

Microsoft Great Plains: Manufacturing or Bill of Materials – Overview for IT Specialist

Writen by Andrew Karasev

Microsoft Great Plains is main Microsoft Business Solutions product, targeted to mid-size companies. Currently Microsoft is in progress of transforming several ERP products it has: Microsoft Great Plains, Solomon and Navision into several business suites – Microsoft Financial, Microsoft HR, Microsoft Manufacturing, Microsoft Logistics.

These suites may be (in the future) put together and work for your company as integrated ERP solution with web interface (Microsoft Business Portal). If you are midsize company with some manufacturing – you should make the research on light manufacturing packages available on software market. In the case of your commitment to Great Plains (if you use it as your accounting system) you should probably first answer this question – do we need full featured manufacturing or we should implement just bill of materials and have missing functionality be filled with custom Crystal Reports and light Dexterity customization?

And one more thing to consider – Microsoft Manufacturing will be more likely build on Navision manufacturing base. If you have process manufacturing – you should not implement GP manufacturing – it is discreet manufacturing.

If you answer yes on most of these questions, you do need manufacturing

  • Do you need Manufacturing Resource Planning?

  • Are Cost Centers required?

  • Do you base your production on the specific Sales Order?

  • Do you track working shifts and allocate the cost?

Now – this is what you can have in Bill of Materials

  • Samples bills of materials – to do the replacement of the items

  • Purchasing configuration, based on ABC codes and other criteria

  • Historical bills reporting

With Crystal Reports you can have this information, having just Bill of Materials

  • Sales/profitability by customer, item, region or custom criteria

  • Future Sales predictions, based on your criteria

  • Employee time and cost allocation

  • Simple Cost Centers, based on product line, specific order or other user defined information

Good luck with your research – we are here to help with Bill of Materials or recommend the best GP Manufacturing partner! If you want us to do the job – give us a call 1-866-528-0577! help@albaspectrum.com

About The Author

Andrew Karasev is Chief Technology Officer in Alba Spectrum Technologies – USA nationwide Great Plains, Microsoft CRM customization company, based in Chicago, California, Arizona, Minnesota, Texas, Florida, New York, Washington, Georgia, Canada, UK, Australia and having locations in multiple states and internationally (www.albaspectrum.com), he is CMA, Great Plains Certified Master, Dexterity, SQL, C#.Net, Crystal Reports and Microsoft CRM SDK developer. You can contact Andrew: andrewk@albaspectrum.com.

akarasev@albaspectrum.com

mp3 players must read before buying

Thursday, April 30th, 2009

MP3 Players – Must Read Before Buying

Writen by Jakob Culver

Often when looking for an mp3 player people get confused and are unsure on what they should be looking for in the product. There are so many different types of mp3 players out there, they come in flash memory, they come with a built in hard drive and you also have the option of using CD to make mp3 playable disc. On top of this you will also have to choose what sort of brands you want, the capacity of the mp3 player and how much it will store and are there any extra features that you want. This is no easy task so lets answer some of these questions now.

When we talk about types of mp3 players there are currently 3 categories on the market. Flash based players, hard-drive based players and mp3 CDs. Lets talk about these.

Flash Based Players

Flash based players are the tiniest mp3 players. They contain a built in flash memory chip and contain no moving parts. Because of there portability, size and the fact that they house no moving parts means that they are the perfect solution if you are going to be listening to your music sport activities. There is one major problem however with these types of mp3 players, they come at a high cost per megabyte of storage. There storage capabilities range from 32MB to 2GB and the most popular models seem to be those from the iRiver iFP series, Creative Muvo line series and the iPod Shuffle series.

Hard-Drive Based Players

Hard-Drive based mp3 players use a 1.8 inch hard disk drive to store music. The hard disk drives can hold huge amounts of data, most come with well over a 20 GB capacity, some will allow you to store up to 60 GB. If you want to be able to store large amounts of music on a portable device (i.e. 1000s and 1000s of songs), than a hard-drive based mp3 player is the way to go. There is however one thing you should be aware of, hard-drives contain moving parts – because of this hard-drive based mp3 player are not suitable if you want to listen to your music while involving yourself in sport. These types of players also come as micro hard-drive players which are smaller but larger than flash based players, there storage capabilities are around the 2 GB to 8 GB range. One of the most popular hard-drive based players is the Apple iPod, the best selling hard-drive based mp3 player.

MP3 CD Discs/Players

Another option if you are looking to have a large amount of music in one unit is to burn your mp3s from your computer onto a mp3 disc. An mp3 disc is a regular CD with mp3s burnt onto it as data. You can normally fit about 150 – 200 mp3s on an mp3 disc and than place it in a CD player that plays mp3 encoded disc. The down side of mp3 discs is that they are of the larger scale and if knocked or bumped will tend to skip a lot.

Well there we go, you have just had a brief overview of the 3 types of mp3 players that exist and the pro and cons that they carry. Hopefully this has helped you a bit to understand the concepts of mp3 players a lot better.

To find out more information about MP3 players or other electronics visit our information and resources site. http://www.electronicsexpressonline.com/

spy web cams

Wednesday, April 29th, 2009

Spy Web Cams

Writen by Max Bellamy

Spy cams are small cameras that transmit video output to a remote receiver. What’s special about them in comparison to other types of cameras is the fact that they are very small, sometimes even as small as a key after they are hidden. A spy cam can be useful in a variety of situations. They are used mostly for surveillance and don’t harm anybody. A particular type of spy camera cameras is the spy web cam. The difference between a spy web cam and a normal spy cam is that the data is transmitted live on the Internet, rather than to a receiver.

Such cameras are used to spy on people, places, and actions in nature.

Browsing the net, one will surely find websites that have such direct live feed. Some of them are displaying adult content and others give viewers the chance to watch something unusual. Live Internet broadcasts such as pay-per-view events usually use more advanced technology than spy web cams. More advanced cameras are utilized for the benefit of the normal paying customer.

Spy web cams are often intended for somewhat immoral reasons. Many Internet sites use this technology to broadcast live places like a public bathroom, a sauna, a strip club, or something else related to naked women, men, or sex. Also, a type of worm has been developed that basically takes control of a normal web cam and broadcasts the signal and the live image to a certain person. Of course, this is against the law, but many people still get a way with doing it.

While some people use spy web cams for illegal reasons, they are usually used for wholesome purposes. People can find hundreds of sites that give viewers a live feedback of a local area or of certain animals in their natural habitat, as well as other actions that give pleasure to people without involving anything adult. They can be useful but at the same time they can be used to spy on unsuspecting people.

Spy Cams provides detailed information about spy cams, hidden spy cams, pinhole spy cameras and more. Spy Cams is affiliated with Discount Laptop Computers.

adware can be a real pain but also it can mean real danger

Wednesday, April 29th, 2009

Adware Can be a Real Pain but Also it Can Mean Real Danger

Writen by John Gauge

Adware is a method by which unscrupulous folk or entities can gain access to the files or systems within your computer and can make use of this by using your web usage details or personal information for their own gain.

Adware is also known as spyware,scumware or malware and a whole host of other nicknames and terms. It is definitely something that must never be taken lightly as the carnage it could inflict could be extremely harmful and worrying.

There are various ways by which spyware can gain access to your computer and this is usually allowed due to the fact that most folk do not have adequate pc security software’s. Even if you do have the best tools then it is essential that you run them via a regular routine.

One of the best examples of what adware or spyware can do is the fact that in some cases it can slow down your pc to the pace of a snail. It can sometimes even have the effect that to start your computer could even take fifteen to twenty minutes if your pc is infected. If this is the case even carrying out the required procedures can be troublesome to say the least.

It is actually not too hard or indeed costly to protect your computer from adware or spyware. Simply download an anti adware software and run it on a regular basis. One thing to remember is that even though there are a stack of free spyware tools out there on the web that you should not kid yourself that they are free, They might find the intruder but ultimately you will have to pay to access this part of the nuker program.

At the end of the day for the sake of a few dollars you will save a heck of a lot of time and could even save your precious files and data.

Yes Adware or spyware can be fatal from the point of view of personal data and software program safety.

Adware can harm..

Files. Programs. Registry. Computer speed and functionality.

Whilst carrying out adware removal there are a few key points to remember that will ensure the job is done correctly.

John Guage writes and researches adware and compiles articles how to remove it for free. details and terrific tips, go to: http://killpopups.info

badly designed languages consistency and tools

Wednesday, April 29th, 2009

Badly Designed Languages, Consistency and Tools

Writen by Duane Hennessy

Most commercial languages and community based languages are easy to understand and use. You may however find yourself in a position where you have to use an inelegant proprietary language that is annexed to an application you have been engaged to support. The language may be used as part of a customisation process. Now for the worst case scenario:

The syntax of the language is extremely irregular and the documentation provided for it is worse!

Having to employ a language that has excessively awkward syntax and unreasonably defined routines you know two things:

  • The language perforce must be consistent for the interpreter to work.
  • There are syntactic rules to the ‘proper’ construction of a clause or a routine.

Even the untidiest rules with some perspiration and serious mental effort will eventually reveal a consistent approach to constructing a routine to achieve a desired result. To understand what the language’s rules are and how they are applied:

  • Read the documentation very carefully to see if it can shed any light upon how to construct an instruction. (As mentioned sometimes the documentation is of no use).
  • Graphically map out example language constructs into flow charts or ER diagrams.

Graphical representations of routines constructed from a badly designed language can vastly improve your understanding of what the language is saying. Charts and diagrams remove the clutter of curly braces, formatting and keywords. The graphic will present you with an abstracted clear view of the flow of the language and the way it instructs an application to do something. The next step is to write out a similar routine using your graphical representations as a guide and see if you can simulate a similar result to what is expected. If you are successful then you have solved some of the language’s mystery.

Once you have a handle upon the language, your next step, if you have time, is to create some kind of interface between the language and yourself. By this I mean divorcing yourself from direct contact with the language by either:

  • Creating a Graphical User Interface through which you create forms or design flowchart diagrams that are then translated to the language’s code.
  • Creating a markup language and a system to convert the markup language to the awkward syntax of the proprietary language.

Both options will need an interpreter that will convert your language to the proprietary language and vice versa. You start by breaking down and mapping the components that make up the proprietary language:

  • Sub-routines
  • Properties
  • Composite keys
  • Definitions
  • Variables etc.

Begin by breaking down the independent components from the largest to the smallest for instance:

  • Publicly declared variables and constants and then
  • large components like routines which have dependent components within them and
  • then breaking down each dependent component.

For example:

property x:5 [independent component]
property t:10 [independent component]

definition “my test property” [large component]
{
property “prop one” [dependent component of definition]
{
edit oneof “property two” relate by “is keyed by” READONLY [dependent component of property within definition]
} ASGRID LENGTH 1200
}

The tools at your disposal to help break down the proprietary code are:

  • Editors that allow you to create customised colouration of the syntax, like Crimson Editor which is free.
  • Regular Expressions to help break up the code efficiently and accurately.
  • Character reading tools.
  • Text manipulation functions within the language from which you will be building your interfaces interpreter.

Once you have learned the proprietary language’s break-down and can represent scripts written in it within your interface, you can then work upon reversing the process so that you can create a proprietary script from your interface.

Things you may want your interface to do for you:

  • Remove the clutter of curly braces and common constructs when converting from the proprietary language to your interface. For instance, there may be a set of words that must always appear together like ‘relate by “is keyed by”‘ you can simply represent it as a tag or a graphic symbol of a key.
  • Add helpful comments when converting back from your language to the proprietary one. For example, should you have to view the proprietary script where there might be nested curly braces, it might be helpful to comment those braces to show the end of each section, for example:

do 1{
code
do 2{
code
do 3 {
code
do 4 {
} // end do 4
} // end do 3
} // end do 2
} // end do 1

To convert the code the interface might break down the components into a database. A table for sub-routines, a table for properties and variables etc. Each component could be ordered by recording the starting position of a component’s first character in the code block (script). This provides the ability to convert the code in both directions as it was originally written or re-write the code in order of component. For example:

You start with a script that looks like this:

property x:5

definition “def One”
{

display dialog x
}

property t:6

definition “def Two”
{

display dialog t
}

Splitting the code into it’s respective tables:

Properties Line=1; Name=x; Value=5 Line=8; Name=t; Value=6

Definitions Line=3; Name=One Line=10; Name=Two

Definition Clauses Line=5; display dialog x Line=12; display dialog t

You can either re-write the lines of code in their respective line/character number order or re-write them by their object order like so:

property x:5
property t:6

definition “def One”
{

display dialog x
}

definition “def Two”
{

display dialog t
}

Once you have decomposed the code into a more manageable format you can manipulate it how you would like.

In recapitulation, when dealing with a badly designed language you carry out the following steps:

  • If possible abstract out some examples of its use into a flowchart or diagram. This will go far to improving your understanding of the language.
  • Create an interface between the language and yourself to make programming in it easier. This will really pay dividends to your use of the language and give you an intimate understanding of it’s quirkiness.

Duane Hennessy Senior Software Engineer and Systems Architect. Bandicoot Software Tropical Queensland, Australia (ABN: 33 682 969 957)

Your own personal library of code snippets. http://www.bandicootsoftware.com.au

Moderator of http://groups.yahoo.com/group/AccessDevelopers

screensavers live flowers on your screen

Wednesday, April 29th, 2009

Screensavers – Live Flowers On Your Screen

Writen by CD Mohatta

Most of you must know about screensavers. A screensaver was normally used to save the screen against prolonged non-use. You can set the time after which the screensaver appears on your screen and protect your screen. Now they are not required for this purpose. But you can still enjoy them whenever you want and relax.

Most of the screensavers are made either with static wallpapers appearing one after other or three-dimensional designs. The latest innovation is live video. In this kind of screensaver, video shots of live objects are taken, edited and made into a revolving film. The film is then given effects and converted to flash. This flash movie, when added to installer, becomes a screensaver.

Now you can view live flowers dancing in the garden on your desktop. With innovation in technology and artistry, the quality of the shot gets enhanced when converted in flash. Installing and uninstalling such screensavers is simple. A click of mouse does that.

Download few screensavers with live flowers on your machines and watch them whenever you are getting bored or tired. Live music accompanies the screensaver adding to the relaxing power. Chose colors that you love. You can also choose flower screensavers with romantic or inspirational text. Bring the beauty of flowers to your desktops and relax with the soothing sight and music.

CDMohatta writes content for Animated Screensavers. The designs include – Flower Screensaversand Love Screensavers

quickbooks training inventory builds using quickbooks pro

Tuesday, April 28th, 2009

QuickBooks Training: Inventory Builds Using QuickBooks Pro

Writen by Jennifer A. Thieme

Although QuickBooks Premier has an official function called Inventory Builds, QuickBooks Pro does not. Here’s a work-around for users of QuickBooks Pro who need to build a unique inventory item from existing inventory parts. This is useful for at least two reasons:

  • Innovative business owners may have ideas that they want to keep proprietary. Taking individual parts, they may want to sell them as a unique group under their own brand.
  • Invoices are long and cumbersome. Grouping individual items together to sell as a unit might be a good solution.

Follow these instructions to build a unique inventory part from individual inventory items:

1. From the Vendors menu, select Receive Items. Make certain the screen says Item Receipt Only and the Bill Received box is unchecked.

2. In the Vendor box, scroll up to create a new Vendor called, For Inventory Builds Only. After this new “vendor” is created, select today’s date, and leave the Reference and Amounts fields blank. In the Memo line, type a brief explanation of what you are doing.

3. Under the Items tab, select all of the inventory parts you want to assemble. Make certain that the Quantity is a negative number, based on how many of each individual item you will use in the new item.

4. Then, under the Item column, scroll up to create a new Inventory Part item. Assign it a name or number that is meaningful to you. Do not enter a cost in the Cost box. Select an appropriate Sales account, and fill in any other information as needed, such as the taxable status or sales price. Click Save and Close.

5. Back at the Item Receipt Only screen, the new item should automatically appear. Enter the amount from the Total line above (in the purple section) as a positive amount into the Cost column of the new item. The Total above (in the purple section) should now change to zero. Enter the Quantity of the new item as one.

Before saving, take a moment to look at what you have done. Can you see how you are simply lowering the quantity and dollar cost of each individual part, while raising the quantity and dollar cost of the new part? As long as you are certain that you have entered the correct amount and type of individual parts, and that the Cost column zeros out (as evidenced by the zero amount in Total field of the purple section), you have completed the transaction correctly. QuickBooks will ask if you want to update the item with the new cost. Select Yes. Click Save and New, or Save and Close, as appropriate.

By following these instructions, you have deducted the individual parts from your inventory, and added a new part with the same exact cost. The net dollar change in the inventory asset account is zero. Accounts payable reports will not be affected, and you are now free to use this new item on customer invoices.

About the Author:

Do you have a specific accounting or QuickBooks problem? Would you like to see an article written about it? Jennifer A. Thieme invites you to contact her today with your accounting or QuickBooks article suggestion. Resolving accounting or QuickBooks issues is her specialty.

Email her today to receive a free initial consultation, free QuickBooks software trial, and a free payroll processing quote.

She’s the owner of Solid Rock Accounting Services and has been in the bookkeeping, income tax, and payroll business for nine years. She’s a Certified QuickBooks Pro Advisor, and a Registered Tax Preparer. Her clients receive QuickBooks training, general bookkeeping, income tax, and/or payroll processing services.

Visit http://www.jenniferthieme.com today for contact information.

detecting network anomalies with netflow

Tuesday, April 28th, 2009

Detecting Network Anomalies with NetFlow

Writen by Jan Nejman

Introduction

The war in Iraq and the War on Terror have changed the focus of all three levels of government. Federal, state and local government – all three are seeking better ways to protect themselves, their equipment and data while working amid pressure-filled and dangerous situations. Of course, security has been the buzzword on Capitol Hill for some time, but generally speaking, physical security took initial priority, followed by outer system protection through intrusion detection and patch management. Security at the application level hasn’t happened yet and is really the most critical. Attacks are becoming more sophisticated than worms or even viruses, and can shut down entire systems.

There are a lot of ways to monitor and analyze your network traffic and protect it from Internet intrusions. Organizations commonly use a firewall for network protection. Although firewall logs often provide a huge information regarding intrusion attempts, sometimes might be of too much data to sort through when there is a problem you cannot resolve it quickly. Some organizations also use intrusion detection systems (IDS) on border routers to analyze incoming traffic for patterns that indicate specific problems. But firewall or intrusion detection system is used primarily on borders with the Internet, rather than on internal networks. This is one of reason why Cisco’s NetFlow came to the rescue.

Netflow Overview Netflow is a traffic monitoring and analyzing technology developed by Darren Kerr and Barry Bruins at Cisco Systems. Netflow describes the method for a router and/or intelligent switch to export statistics about the data flow, and this built-in feature is found on most Cisco routers (http://www.cisco.com) as well as Juniper (http://www.juniper.net), Extreme Networks (http://www.extremenetworks.com), Riverstone (http://www.riverstonenet.com) etc. NetFlow technology provides the data necessary to effectively analyze trend and baseline application data as it passes through the network. It can then be exported to a reporting package and can provide the information necessary to manage critical business applications.

What is Netflow? Netflow is defined as a unidirectional sequence of packets between a given source and destination which means there will be two flows for each connection session, one from the server to client, one from the client to server. In order to distinguish flows from one another, the source and destination addresses, protocol and port numbers are used. The Type of Service and source input interface index are also used to uniquely identify the flow to which a packet belongs. A flow is determined to have ended when it has been idle for a specified length of time, when it has become older than a specified age (30 minutes by default) or when the flow is a TCP connection a FIN or RST has been sent. The router may expire flows more aggressively if it is running out of cache space.

A number of router vendors have implemented their version of netflow, but version 5 is now the most common. For a NDE version 5, every single UDP packet contains one flow header and thirty flow records at maximum. Every flow record is made up of several base fields and the rest which include: next hop address, output interface number, number of packets in the flow, total bytes in the flow, source and destination AS number, source and destination network length and TCP flags (cumulative OR of TCP flags).

What is Caligare Flow Inspector? Caligare Flow Inspector (http://www.caligare.com/netflow/cfi.php) is a unique network software solution for companies, who need to plan, build, maintain and manage their network and at the same time keep their network more secure and efficient. Caligare Flow Inspector is a web-based bandwidth monitoring tool that uses NetFlow data export to provide detailed traffic statistics that help answer who, what, when, where of bandwidth usage.

CFI software was engineered to create a secure network-monitoring platform based on industry standards that will fit your existing security policies. The results are the ability to monitor in real time, significantly reducing the time it takes to identify problem and troubleshoot. CFI keeps track of what is happening in your corporate network, detecting attacks, and warning you of problematic network users. All information about network activities are archived in a central database.

Baseline Analysis A baseline analysis is a model describing what “normal” network activity is according to some historical traffic pattern; any other traffic that falls outside the scope of this traffic pattern will be flagged as malicious. A trend analysis reports is the most common and basic method of doing flow-based analysis. In netflow analysis is main focus on records that have some “special high traffic volume” attribute, especially the value of those flow fields that deviate significantly from an established historical baseline. Normally there are two ways to make use of baseline analysis methods: top sessions and top data.

Top sessions A top sessions means a single host tries to open an abnormally high volume of connections to a single node or block of nodes. The most reasons for these activities are worms, denial of service attacks and network scans.

Common clients connecting to the Internet should keep a relatively normal connection frequency. But if a host is infected with a worm, it will absolutely act different. It will mostly open a huge number of connections to the destination for its attempts

to infect the next batch of victims. For the same reason, when a lesser-skilled “script kiddies” is scanning a large block of addresses for certain vulnerable services, we will see especially high volume sessions sent out by that single IP address.

We can also use top sessions method to detect many kinds of network abuses, such as checking the flow records for port 25 connection requests sent out by every single host in real time. In a given duration, for any host, if the statistics of port 25 requests are above a ‘normal’ value, it could be considered to be a spammer or someone infected with some kinds of email worm. It would be better for the Internet as a whole if service providers started using this technology and shut down the spammers upon detection.

Top data streams A second method of using baseline analysis is top data. This can be defined as a large amount of network data transferred in a certain period of time from a single host to a single destination or block of destinations.

The Top hosts that transfer traffic data to or from the outside in an enterprise should be ranked into relatively fixed groups. If this pattern changes, and a new host suddenly appears in the Top hosts matrix, an alert should be triggered.

How to find out if I am being attacked? Traffic inspection and analysis is a very complex problem. On the market there are many tools as IDS, network traffic dump or network probes, but lack of them can process big traffic volume (e.g. 10TB/hour). We decided to use netflow data export (NDE) that is widely available on most high-end routers for user tracking and real time data flow analysis. Netflow brings transparent view what is happening in your network. There are several methods how to detect if “your” network is under attack.

  1. Packet size distribution. Many short packets (more than 60%) may signify suspicious traffic.
  2. Many connections from single host to considerable destinations.
  3. Using reserved or private IP address on the Internet.
  4. Excessive number of ICMP messages.

In the latest version of Caligare Flow Inspector software there is implemented packet distribution statistic. In our company we are using small honey pot network (without any real stations) for attack analyzing. You can use the following steps to locate the source of the problem and some tips on how to filter suspicious traffic.

Finding infected stations in your network NetFlow Inspector software is the ideal tool for detecting worm sources (infected stations) in your network. Trends menu may be used for this type of analysis. The following example gives you information on how to find infected stations in your local network.

Log into Caligare Flow Inspector and run the following steps:

  1. Select collector that stores netflow data exports (in our case: router R01).
  2. In the table selector choose current hourly table.
  3. Select statistic: source host distributions.
  4. Set source interface (Gigabit Ethernet 1/1).
  5. Set destination interface (not Gigabit Ethernet 1/1).
  6. Run search query.

After displaying source host distributions you can view top ten source IP addresses sorted by number of used unique destination IP addresses. These source IP addresses are candidates on the infected stations.

Check result and select possible infected stations (infected station pool more than 500 unique destinations in most cases). Ignore your servers that are normally heavy used. Web or application servers normally generate many connections to many destinations.

Write top 5 sources to notebook and then continue to infected station confirmation step. For each candidate IP address run the following query:

  1. Set statistic: destination ports by packet.
  2. Source IP address:
  3. Run search query.

Check destination ports that are in use by potentially infected station. In most case (when station is infected) you will see some of following ports: netbios (137, 138, 139), microsoft-ds (445), ms-sql-s (1433), www (80, 3128) etc (see picture 4).

Now, is a good time to consider if your candidate is infected or not. Decision is yours, because only you know “your” network and servers. If a station opens more than 500 unique destination connections to port 1433, this seems like very suspicious activity.

How to find out who attacked my network? The infected station tries to open a connection to all the servers in your network. You can simply locate this attack by finding the source host that is trying to open a connection to various destinations in your local network.

Check caption “Finding worm sources in your network” and how to find these source hosts. Sophisticated worm sources do NOT pool your whole network, but instead randomly or pseudo-randomly try to open from time to time a single host connection. Locating these attackers is difficult but NOT impossible! You can use TCP flags and ICMP tracking. When the attacker tries to open the TCP connection to an unused destination IP address the TCP SYN flag is set. If the connection is successful you will see cumulative TCP flags SYN and ACK, if the connection is unsuccessful you will see only flows with SYN flag. You can count the unsuccessful connections for every source IP address outside your network and source, the one with the most of connections found is your attacker candidate. If attacker is using UDP protocol and pools your whole network, an excessive number of ICMP messages will then be generated.

How to find out who attacked me? If you suspect (or know) that your station is victim to an attack, then you probably want to know who is the attacker. Locating the attacker is simple if source IP address is NOT spoofed. Select “Trends” menu and use “Source host by packet” statistic. Type in your IP address (victim) into destination host field and run search query. Result is a list of source hosts who communicated with you sorted by number of packets. Often the first host located is the attacker. In case source IP address is spoofed (often used reserved or private IP address) you can only locate source interface through that malicious traffic going into your station. You can not filter this attacker if he uses random source IP address, you can only contact provider or your ISP peer operator.

Protection and Prevention You can use many protection mechanisms, these are widely available through access lists on Cisco routers.

  1. Create new access list: ip access-list extended
  2. Add block rule: deny ip any
  3. Repeat step 2 for each attacker
  4. Permit any other traffic
  5. Check access list rules: show ip access-list
  6. Apply access list on source interface: ip access-group in

Example:

 configure terminal ip access-list extended block_attacker

deny ip 10.0.0.0 0.255.255.255 any

deny ip 192.168.0.0 0.0.255.255 any

deny ip 80.95.102.33 0.0.0.0 any

permit ip any any

permit pim any any

permit igmp any any

exit interface GigabitEthernet 1/1

ip access-group block_attacker in

exit 

Be very careful before updating access list! On many routers the default rule is drop any traffic if access list exists. We recommend removing access list from interface then creating a new access list and reassign it to interface. On picture 3 is the result of applying access list on our router R01 that was applied at 10:03.

Summary This attack detection manual has discussed the flow-based analysis of malicious traffic and abnormal activities. With top sessions and top data methods, network administrators can simply detect network anomalies in real time more effectively. There is no universal process on how to find source of attack, but with Caligare Flow Inspector software we may make your corporate network run better.

Full story with images and examples is on the: http://www.caligare.com/articles/worms.php

Caligare delivers the most intelligent and secure networking solutions in the industry, and we back the program with our commitment to making our partners successful. We measure success in terms of customer satisfaction, as well as partner profitability. Caligare is providing the Linux based software, to provide a solution that dramatically reduces the cost of providing security, for the midsize and large businesses or agencies. Our goal is to help our customers get an efficient software tool at a reasonable price.