An overview of SNIF: a tool for Surveying Network Information Flow

Connection of a local area network to the Internet brings with it a certain amount of risk. Once connected, local computer systems are subject to attacks by other users on the Internet. To maintain system integrity, system administrators need tools to accurately display the status of communication between local hosts and remote hosts. The paper describes an ongoing research and development project for Surveying Network Information Flow (SNIF). The SNIF tool provides system administrators and security officers an encapsulated view of network communication and information flow for a set of monitored subnetworks. The tool provides a real-time graphical interface, configurable monitoring, alarms and signals, connection statistics, and an extensible interface to permit links to external systems (LES). This tool is one of many in a suite of security tools being developed at the University of Idaho