topic How do you profile connections to a system using Stream? in Knowledge Management https://community.splunk.com/t5/Knowledge-Management/How-do-you-profile-connections-to-a-system-using-Stream/m-p/410051#M8452 <P>Guys, I inherited a load of Windows Domain Controller servers am I'm tasked with upgrading them and decommissioning some of them. Thing is we have tonnes of Linux stuff using them and lots of those systems have hard-coded one DC for DNS/LDAP lookup, auth etc. Worse still, some are critical production systems, so shutting off their only LDAP/DNS sever is not an option <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>So, I can hide a DC from Windows OS not problem using/32 subnets. I have then been using tshark to track incoming requests and see who's still looking for it. This scales horribly though when you have 100 DCs <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>SO, I was thinking of using Splunk for stream to track incoming connections for things like DNS,LDAP etc. I know I'm being lazy and should read all the docs etc. but I have little time to do this.</P> <P>Can anyone point me in the direction of how to achieve this?</P> Fri, 05 Oct 2018 20:13:48 GMT shocko 2018-10-05T20:13:48Z How do you profile connections to a system using Stream? https://community.splunk.com/t5/Knowledge-Management/How-do-you-profile-connections-to-a-system-using-Stream/m-p/410051#M8452 <P>Guys, I inherited a load of Windows Domain Controller servers am I'm tasked with upgrading them and decommissioning some of them. Thing is we have tonnes of Linux stuff using them and lots of those systems have hard-coded one DC for DNS/LDAP lookup, auth etc. Worse still, some are critical production systems, so shutting off their only LDAP/DNS sever is not an option <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>So, I can hide a DC from Windows OS not problem using/32 subnets. I have then been using tshark to track incoming requests and see who's still looking for it. This scales horribly though when you have 100 DCs <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>SO, I was thinking of using Splunk for stream to track incoming connections for things like DNS,LDAP etc. I know I'm being lazy and should read all the docs etc. but I have little time to do this.</P> <P>Can anyone point me in the direction of how to achieve this?</P> Fri, 05 Oct 2018 20:13:48 GMT https://community.splunk.com/t5/Knowledge-Management/How-do-you-profile-connections-to-a-system-using-Stream/m-p/410051#M8452 shocko 2018-10-05T20:13:48Z