Glossary

Plixer FlowPro Terms

BotNet
A network of private computers infected with malicious software and controlled as a group without the owners’ knowledge
Command and Control
Command and Control cyberattacks (C2 or C&C) happen when bad actors infiltrate a system and install malware that lets them remotely send commands from a C2 server to infected devices
Data exfiltration
Unauthorized data transfer, either manually from a device or over a network
DGA (Domain Generation Algorithms)
Algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with the command and control servers
DNS Data Leak
DNS server requests that are visible to third parties
Domain Reputation List
List of domains that have been determined, with a high probability, to be “bad domains”
DPI (Deep Packet Inspection)
An advanced method of examining and managing network traffic, functioning at the application layer of the OSI model
JA3 Signature
A method to fingerprint an SSL/TLS client connection based on fields in the Client Hello message from the SSL/TLS handshake. So named as it was first published by John Althouse, Jeff Atkinson, and Josh Atkins from Salesforce in 2017.
NXDOMAIN (No Existing Domain)
Error message indicating that the domain is either not registered or invalid
Observation Domain
A value used by the collector device to group devices when receiving data sessions
plixer.ini
Plixer FlowPro configuration file.
Trusted Domain list
List of domains that are allowed on the network (whitelisted)

General Networking Terms

2LD (Second-level Domain)
Part of the naming convention domain names. For example, in example.com, example is the second-level domain of the .com TLD (Top level domain)
3LD (Third-level Domain)
For example, in www.mydomain.com, www is the third-level domain
API (Application Programming Interface)
A software component that allows applications to share data and functionality
CA (Certification Authority)
A trusted entity that issues, signs, and stores digital certificates
CIDR (Classless Inter-Domain Routing)
An Internet Protocol addressing method that improves the efficiency of allocating IP addresses. The general way of representing the CIDR IP address is a.b.c.d/n with n representing the number of bits used for the identification of the network.
CLI (Command-line Interface)
A text-based interface for applications and operating systems that allows a user to enter commands and receive
Collector
SIEMs, Flow Collectors, SNMPTrap Receivers, or other network management systems that analyze data forwarded by the Plixer Replicator from other networked devices
DNS (Domain Name System)
The system by which computers and other devices on the Internet or Internet Protocol networks are uniquely identified using names matched to their IP addresses
Egress
Traffic that exits a device or network
ERSPAN (Encapsulated Remote Switched Port Analyzer)
A Cisco proprietary feature that brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains
Exporter
A networked device such as a router, switch, or server that generates data and sends it to the Plixer Replicator for replication and forwarding
Fault tolerance
A system’s ability to continue operating without interruptions in the event of a hardware or software failure
FQDN (Fully Qualified Domain Name)
The comple domain name of a specific computer, host, or online presence. For example, Plixer’s website’s FQDN would be www.plixer.com
GRE (Generic Routing Encapsulation)
A tunneling protocol developed by Cisco Systems
IP address
A unique numerical label assigned to a networked device
IPFIX (Internet Protocol Flow Information Export)
A protocol that standardizes Internet Protocol flow information from networked devices
Latency
The latency of a network is the time it takes for a data packet to be transferred from its source to the destination
LDAP (Lightweight Directory Access Protocol)
An open, cross platform protocol used to authenticate and store information about users, groups, and applications
MAC (Media Access Control) address
A unique hardware identifier typically assigned by manufacturers to network adapters and devices
NIC (Network Interface Card)
Adapter that provides devices network connections, either wired or wireless
OVF (Open Virtualization Format)
An open-source standard for packaging and distributing virtual machines and software applications
Packet
A block of data transmitted across a network
Redundancy
Duplicated or alternative network devices and connections meant to serve as a failsafes against the primary service becoming unavailable
Router
A device that forwards or routes data packets to devices on a network
Server
A system or device that provides resources, data, services, or applications to other devices over a network
SIP/RTP (Session Initiation Protocol/Real Time Protocol)
SIP is the control protocol, and RTP is the payload protocol used to send and receive Voice over IP (VoIP)
SSH (Secure Shell Protocol)
A network communication protocol that allows network services to be used securely over an unsecured network
SSL (Secure Sockets Layer)
A protocol for establishing secure connections between networked devices
Switch
A device that connects devices in a network and allows them to communicate with each other
Syslog
A standard for message logging that allows a wide variety of networked devices to share the same repositories and management systems
TLS handshake (Transport Layer Security)
TLS is a network protocol used to ensure secure and private communications over the internet. A TLS handshake is the process that kicks off a communication session that uses TLS encryption
UDP (User Datagram Protocol)
A communication protocol used by applications to send messages to other hosts on an Internet Protocol network via low-latency, loss-tolerating connections
Virtual appliance
A pre-configured virtual machine image with pre-installed software meant to serve a specific function
VoIP (Voice over Internet Protocol)
A technology that allows voice calls using an internet connection