Network and server profiling is used to establish normal traffic on a network and server and, therefore, to help identify incidents in action. Profiling also allows administrators to identify any potential future problems, such as a lack of redundancy, or bottlenecks in the system.
Profiling is a fundamental network security task. Knowing what normal is allows us to better identify what isn't normal, and sets us on the path to defeating a threat.
The following topics will be covered in this chapter:
- Network profiling
- Server profiling
