A five topple refers to a set of five different values that are used to analyze security events it includes
a source IP address and port number destination IP address and port number and the protocol used in
this example the top host had IP address and zeroed out one to allow even use source port.
Sixty five thousand one TCAP protocol as it's transport with the destination IP address of 10.0 not
one to 12 and destination port of 445.
Let's take a look at a couple of examples of how you could find your five top all information for connections
between hosts.
So here I am in Wireshark and let's say that I was investigating an issue with an appoint.
So I wanted to correlate five topical information.
I could easily do so from here.
So let's say I wanted to find out information for this connection from my PC to this destination address.
I could just double click on that connection.
I can see the source and destination IP addresses.
I can see the transport protocol was TCAP as well as a source port number and destination port number
and other useful place to know how to find five all information is from a firewall log I am in the lab
with a Cisco firewall.
There are a few different ways you can find your five total information.
Well I like to do is run the command show connection detail
and here you have a nice summary of all your connections as well as your IP address information transport
protocol and port numbers.
So if I wanted to drill down into a suspicious connection let's say regarding this IP address
I could just filter to that destination to collect five table information.