RTM: flow-based network monitoring

How does this differ from Silk+Flowbat?

Wait. How do I actually download this and where's the documentation?

RUAG was hacked over a year ago an didn't notice until recently when the intelligence agency informed them. It's a huge scandal here.

http://www.swissinfo.ch/eng/ruag-affair_sensitive-personal-i...

http://www.blick.ch/news/wirtschaft/beunruhigender-hack-wie-...

Judging from screenshots, RTM does a deeper level of packet inspection than netflow based system (silk/flowbat).

As Silk/Flowbat are based on netflow records, which doesn't inspect the traffic passing across the network. It just records surface level information about the traffic. Source/Dest ports and addresses, UDP vs TCP and length and size of the conversation.

Deeper packet inspection probably results in rtm being able to inspect less traffic. Though depending on how RTM is written and the network drivers being used and your network size, you still might be able to have this monitor your egress points.

you're right. An other example why it's a good idea to invest into smart people supported by good products in order to defend against such attacks. From my personal point of view, the risk of a data-breach is beeing underestimated in almost all companies. Which leads toh harsh budget restrictions for security responsibles.

Note: in my opinion Blick.ch [1] is not the best ressource for information. Please consider [2], [3].

[1]: http://www.blick.ch/ [2]: http://www.derbund.ch/wissen/technik/organisation/ruag/s.htm... [3]: http://www.nzz.ch/nzzas/cyber-attacke-gegen-ruestungskonzern...