Knowledge Management

How do you profile connections to a system using Stream?

shocko
Contributor

Guys, I inherited a load of Windows Domain Controller servers am I'm tasked with upgrading them and decommissioning some of them. Thing is we have tonnes of Linux stuff using them and lots of those systems have hard-coded one DC for DNS/LDAP lookup, auth etc. Worse still, some are critical production systems, so shutting off their only LDAP/DNS sever is not an option 🙂

So, I can hide a DC from Windows OS not problem using/32 subnets. I have then been using tshark to track incoming requests and see who's still looking for it. This scales horribly though when you have 100 DCs 🙂

SO, I was thinking of using Splunk for stream to track incoming connections for things like DNS,LDAP etc. I know I'm being lazy and should read all the docs etc. but I have little time to do this.

Can anyone point me in the direction of how to achieve this?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...