Rolling PCAP (Packet Capture) for a production network

It is common to see many SOCs (Security Operations Centers) wanting a packet capture of a recent event to trace down some network activity either part of an attack or an investigation.  A file format called PCAP is a good way to store network data on the disk.  However no one can afford to store PCAP forever, so a rolling packet capture depending on your network bandwidth is a very viable way to collect and store PCAP.

Overcoming your CDN provider in web logs

As I consult with clients on security incidents in large organizations, they always puzzled by an incident that shows all their web attacks as originating from either Akamai or Amazon.  This is typically due to some reconfiguration of application services to be distributed using a CDN (Content Delivery Network).  It is not surprising for organizations like Target after a large breach incident to sift through millions of logs only to find attacks appear to have come either through a trusted service provider (like Akamai) or through a partner.

Human friendly printing numbers in command line

When I am on Unix system running things of from command line (either SQL or shell of any sort) with long number, I find these numbers hard to read.  For example a printout of netstat packets shows

236477161 packets

Which is really 236.4  million packets, a human friendly representation will be more like

236,477,161 packets

DNSSEC maintenance tools

DNSSEC has a reasonable effort for one time setup but even more pain comes in managing the keys, expiry and updating your keys and then adding DS (Delegation Signer) keys with your provider or DLV (DNSSEC Look-aside Validation) to the less ideal DLV. system.

Inconvenience != Security

Many people have suggested idea for how they can better secure their users from doing stupid mistakes and ask for my opinion.  Most of these ideas (IMO) seems to add just inconvenience to the user without improving security.  So, my quote for this has been

"While security is not convenient, just inconvenience is not security either!"

My favorite egrep patterns

When it comes to using finding matching patterns inside text files, log files and text emails; egrep is very useful tool in your UNIX toolbox.  Here are some of these to find IP addresses, emails, URLs ...

DNS PCAP and BPF

DNS most interesting protocol can be analyzed using some packet filters that can help you look at and analyze various types of DNS packets on the network.  In this blog, I am compiling a list of these to summarize the ones I have discovered as useful for analyzing DNS packets.  The examples are relevant to UDP DNS which is about 90-95% of DNS packets seen.