Network Posture Visibility

Network Posture Visibility is a network security analytics tool that identifies traffic patterns matching common DDoS amplification attack vectors within your protected infrastructure. It provides near real-time visibility into traffic that indicates potential misconfigurations or vulnerabilities that could be exploited for distributed denial of service attacks.

Network Posture Visibility helps you discover exposed services before they can be weaponized by attackers by analyzing traffic originating from ports typically used by amplifiable services (DNS, NTP, LDAP, SSDP) as well as suspicious patterns like fragmented packets and unusual UDP traffic.

More network observability and analytics tools coming in the future will enable you to investigate network issues easier than ever before.

Key capabilities

Vulnerability detection

Shows traffic patterns that indicate exposure to the six most common DDoS amplification attack vectors, originating from source ports that should typically be destination ports (DNS, NTP, LDAP, SSDP), indicating unusual service behavior.

Scale assessment

Displays flow counts for each vector, allowing you to assess whether exposure is sporadic (few flows) or significant (thousands/millions of flows), enabling proper prioritization.

Detailed flow visibility

Provides source IP, destination IP, ASN, and flow count for traffic matching each vector, enabling investigation and remediation tracking.

Time-bound verification

Allows you to specify a time range from 5 minutes to 30 days or use several predefined periods, such as yesterday, last 7 days, etc.

To access Network Posture Visibility:

Log in to the Control Center.
Go to ☰ > Common Services > Reports
In the Reports menu, select Prolexic > Network Posture Visibility

See How to use reports for more information.

Dashboard structure

Network Posture Visibility dashboard consists of two main sections:

Summary view (top-level bar)

Each summary card shows the total number of flows matching that vector during the selected time period, providing an at-a-glance assessment of your overall exposure.

A summary bar displays aggregate flow counts for all six DDoS vectors:

Flow counts	Description
SOURCE PORT 53	DNS amplification traffic
SOURCE PORT 123	NTP amplification traffic
SOURCE PORT 389	LDAP amplification traffic
SOURCE PORT 1900	SSDP amplification traffic
UDP PORT 80	Unusual UDP traffic on HTTP port
FRAGMENTS	Fragmented packet traffic

Detailed vector dashboards

Network Posture Visibility monitors traffic patterns that indicate vulnerability to six common DDoS attack vectors. The dashboards are expandable sections below the summary bar, allowing you to drill into specific vectors of interest. Six detailed dashboards (one for each vector) display granular flow-level information. By default, each dashboard displays up to 100 items with pagination controls (10 items per page).

Each dashboard contains a table with the following columns:

Vector	Description
Source IP	The IP address originating traffic matching the DDoS vector. Use this vector to identify which systems in your infrastructure are exposed.
Destination IP	The IP address receiving traffic matching the vector. This helps to identify which specific assets or services are receiving this traffic.
ASN	The Autonomous System Number associated with the source IP address. This helps to identify geographic origin, ISPs/hosting providers, known malicious networks, and patterns indicating scanning vs. targeted reconnaissance.
Flow Count	The number of flows observed between the specific source-destination IP pair during the selected time period. Higher flow counts indicate more active communication, greater potential for exploitation, and higher priority for investigation.

Filtering

Start with the Select filters tab, where you choose the data that you want to view.
Required filters:

Date range - The time range for which the data will be displayed.
Security configurations - The security configurations for each unique datacenter asset. One or more can be chosen.
Protected prefixes - The network subnets protected by Prolexic for each Security Configuration.

The data in Network Posture Visibility is displayed for these selected subnets. You can access the network data using other methods:

Download a CSV file from each dashboard
Display the API calls to consume the data for a specific dashboard.

Amplification service ports (DNS, NTP, LDAP, SSDP)

This category includes four commonly exploited amplification attack vectors:

SOURCE PORT 53 - DNS (Domain Name System)
SOURCE PORT 123 - NTP (Network Time Protocol)
SOURCE PORT 389 - LDAP (Lightweight Directory Access Protocol)
SOURCE PORT 1900 - SSDP (Simple Service Discovery Protocol)

These services typically receive requests as the destination port (clients connecting to your DNS/NTP/LDAP/SSDP servers on these ports). Traffic with these ports as the source port indicates your infrastructure is initiating connections to external destinations using these service ports, which is unusual. Services like DNS, NTP, LDAP, and SSDP are not expected to initiate outbound connections to the internet using their service ports. Seeing this traffic pattern warrants investigation to understand why these services are behaving this way.

UDP PORT 80 (Unusual UDP traffic)

Port 80 is typically used for HTTP over TCP, not UDP. UDP traffic on port 80 is unusual and often results from misconfiguration when administrators intend to open TCP port 80 for web services.
UDP port 80 traffic is rarely legitimate and may indicate configuration errors in firewall rules or security groups.

FRAGMENTS (Fragmented packets)

Most legitimate traffic uses standard-sized packets. Fragmentation is relatively rare in modern networks with proper MTU discovery. High volumes of fragmented packets can indicate fragmentation-based attacks or attempts to evade security controls. Fragmented packets may represent attack traffic or attempts to bypass security systems. High volumes warrant investigation.

Samples

Network Posture Visibility relies on sampled flow data, as known as sFlow. The number of flow samples used for the traffic analysis is displayed at the bottom of each dashboard. This sample count validates the credibility and statistical significance of the findings - higher sample counts provide greater confidence in the accuracy of the displayed traffic patterns.