Protocols

The wire protocols that carry monitoring telemetry are attack surfaces in themselves: SNMP exposes device data and configuration and is often weakly authenticated, syslog ingestion trusts its input and is spoofable and injectable, and NetFlow/IPFIX collectors hold the network's traffic map. Each leaks information or lets an attacker poison what operators see.

1 min di letturaaggiornato il 7 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

Before the platforms, the telemetry protocols themselves are attackable. SNMP is the richest: a widely deployed, frequently weakly-authenticated protocol that reveals a device's entire state and, with write access, reconfigures it. Syslog is a trusting, usually unauthenticated ingestion path that an attacker spoofs, forges, and floods to poison the record operators and SIEMs rely on. And NetFlow/IPFIX collectors hold the map of who talks to whom across the network, valuable reconnaissance and a target for forged records. These are protocol-level attacks, independent of which platform consumes them.

Subtopics#

  • SNMP: device data disclosure, weak community strings, and write-access abuse.
  • Syslog: spoofing, injection, and flooding of the log stream.
  • NetFlow and IPFIX: harvesting and forging network flow telemetry.

References#

PrecedenteMonitoringSuccessiva SNMP