From the command-line to the board room.

htmlWorking with Bro Logs: Queries by Example htmlCreating a Minimal Bro Cluster htmlTuning Snort Rulesets with Bro Data htmlNSM Sensor Perspectives - Examples of a Topology Map htmlFinding Malware by DNS Cache Snooping or by Comparing BRO and PassiveDNS logs htmlARGUS - Detecting Protocols on Non-Standard Ports with Flows htmlPassiveDNS - Logging DNS requests htmlSecurityOnion - Connecting to Sguild htmlSecurityOnion - Moving the MySQL databases htmlSnorby's Asset Manager - Convert and Upload /etc/hosts htmlThe Pig Doktah - A Snort Performance Metric Tool htmlSnort - Offline Analysis htmlConfiguring a Network Monitoring System (Sensor) on Ubuntu Server 12.04 - Part 1: Interface Configuration htmlAPR (ARP Poison Routing) Detection

htmlCase Study #1: Using Traffic Analysis to Investigate an IDS Alert htmlReading Multiple PCAPs - Header Dissection and a Little Cmd-Fu htmlExtracting SSIDs from PCAPs - Multiple Methods htmlNetsniff-NG (Ubuntu Community & Fedora Wiki) htmlThe Trafgen Expression Language htmltcpdstat - a statistical data program and a compilation fix htmlMausezahn: As a Protocol-Aware Packet Crafting Server htmlMining networks for PII with ngrep htmlExtract an Attachment from a Phishing E-mail (eml) w/ base64 and sed htmlTCPTrack - Simple TCP Connection Monitor htmlnetsniff-ng - a high performant packet sniffer htmltcpick - tcp stream sniffer and connection tracker htmltcpflow - a tcp/ip session reassembler htmliftop - finding traffic hogs htmltcpstat - Network Statistics htmlSpeedometer - A Graphic Network Throughput Tool htmlhttpry - HTTP logging and information retrieval tool htmlHack3rcon^3, The XRG - CTF Challenge #1 Solution - Analyze PCAP htmlHack3rcon^3, The XRG - CTF Challenge #4 Solution - Decrypt PCAP (WEP), Extract file

htmlNET_DROP_MONITOR: Monitoring packet loss in the Linux kernel htmlNagios and DNS Resiliency with Unbound htmlLog Storage and Analysis Infrastructure: Reliable Logging and Analysis with Rsyslog and RELP htmlCHECK_NRPE: ERROR - Could Not Complete SSL Handshake htmlNagios Configuration Tips and Tricks: Shell Edition htmlNagios Deployment Automation Tips and Tricks htmlifpps - top-like network statistic tool htmlInterface down? - Alerts with ifpps htmlAutomate Patch E-mails with Git Hooks htmlQuery Interface Bandwidth via SNMP on Cisco Routers htmlAutomated backups of a SonicWall NSA (or other device) w/ Expect htmlSonicWall NSA - Log Reviews with grep

htmlPacket Loss Under Light Load: Invalid Packets or Line Noise? htmlCreating a Personal Privoxy/Tor/Proxy EC2 Instance htmlCreating an Anonymization Gateway (Middlebox) with Tor and OpenBSD 4.9 htmlCreating a Hidden Management Network with IP Aliasing using Linux, FreeBSD, and OSX htmlLog Query Examples w/ Splunk htmlIntroduction to Auditing on AIX htmlKeeping Up With News: An Efficient Approach

htmlOSX Live Memory Forensics with Volatility and MacMemoryze htmlOSX Keychain - Administration and Psuedo SSO htmlOSX Server - Automated backups of Open Directory htmlOSX 10.5-10.7 - Basic Security Settings htmlOSX - Remote Logging /Library/Logs

htmlBash Defensive Measures - Shell History & Logging htmlNmap & Ndiff: Detecting Compromised Hosts htmlNipper - Firewall & Router Configuration Parser txtUnderstanding Passwords Part 1: Theory, Hashing, and Salting txtUnderstanding Passwords Part 2: Attacks by Example