Published By
Created On
11 Jul 2023 15:39:11 UTC
Transaction ID
Cost
Safe for Work
Free
Yes
windows 11 and xmas scans
Observing Windows 11 during a XMAS scan
I encourage people to spend a few minutes and learn how devices respond to certain scenarios. This is one of the tasks my regular clients ask me to perform.
One of those examples would be to download Nmap and run the scan on a device within your network.
The benefits of this example are countless; You get to practice and develop nmap skills, you get more practice with Wireshark and protocol analysis, and lastly you get to learn the real behavior of various devices on the wire, not by reading a theoretical white paper.
In this video I take a windows 11 device and run a nmap/Xmas scan against it, change one simple variable, disable the windows firewall and repeat. This exercise was inspired from a conversation I had one in one my onsite training sessions where people were debating if a windows 11 device would respond to a Xmas scan. As the discussion progressed, people were throwing in variables such as what if the firewall was enabled?
I interrupted and simply suggested to the group “Why not find out instead of theorizing?”. So we started our captures, randomly scanned a windows 11 host, and reviewed the results.
In the following video I cover the basics of what we did and encourage you to do the same. Feel free to try all sorts of devices you might have available to you within your network such as printers, phones, cameras, routers, switches and anything else you can think of.
...
https://www.youtube.com/watch?v=S5AAo8QpGhk
I encourage people to spend a few minutes and learn how devices respond to certain scenarios. This is one of the tasks my regular clients ask me to perform.
One of those examples would be to download Nmap and run the scan on a device within your network.
The benefits of this example are countless; You get to practice and develop nmap skills, you get more practice with Wireshark and protocol analysis, and lastly you get to learn the real behavior of various devices on the wire, not by reading a theoretical white paper.
In this video I take a windows 11 device and run a nmap/Xmas scan against it, change one simple variable, disable the windows firewall and repeat. This exercise was inspired from a conversation I had one in one my onsite training sessions where people were debating if a windows 11 device would respond to a Xmas scan. As the discussion progressed, people were throwing in variables such as what if the firewall was enabled?
I interrupted and simply suggested to the group “Why not find out instead of theorizing?”. So we started our captures, randomly scanned a windows 11 host, and reviewed the results.
In the following video I cover the basics of what we did and encourage you to do the same. Feel free to try all sorts of devices you might have available to you within your network such as printers, phones, cameras, routers, switches and anything else you can think of.
...
https://www.youtube.com/watch?v=S5AAo8QpGhk
Author
Content Type
Unspecified
video/mp4
Language
English
More from the publisher
Controlling
VIDEO
SHOWI
showing-you-how-to-figure-out-bittorrent
LIKE if you want more videos on baselining
Write up at
http://www.lovemytool.com/blog/2013/06/figuring-out-bittorrent-behavior-with-wireshark-by-tony-fortunato.html
...
https://www.youtube.com/watch?v=aKKDRnZeSJ4
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
WIRES
wireshark-io-graphs-and-filters
WIRESHARK IO Graphs And Filters
Its been over 20 years of installing, troubleshooting, training and writing and I still think the biggest issue in IT is the technician’s working knowledge of their everyday tools. It doesn’t matter if it’s a physical tool like a cable tester or software, you should not only be familiar with it, but with any changes with upgrades.
In this case I chose Wireshark and wanted to show you how display filters affect IO graphs. As I mentioned in the video, this can be ‘bad’ or ‘good’. Which one depends if you know about this new ‘feature’ or not.
I always suggest you ‘use your favorite tools one a regular basis so you can spot some of these changes when they appear so you aren’t caught off guard when you are in the middle of troubleshooting.
...
https://www.youtube.com/watch?v=M_8m-U-9YwQ
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
VIDEO
WIREE
wireedit-quickstart
I apologize for disappearing for a while but I'm involved in a fairly large project that has me working ridiculously long hours.
I've written about packet editing tools and how every analyst should have one. To this day I still get asked why bother with these tools, so lets cover it.
If you have a trace file that you want to share with a vendor ro post online, you might want to change any public ip addresses or data.
A while back I showed you how to edit a packet using Wireshark's Packet Editor and Jasper's cool app Tracewrangler.
Then one day Jasper mentions Wireedit and had no idea what he was talking about, so here you go folks. In this video I show you how to use Wireedit to edit a packet or make a bulk change.
https://omnipacket.com/downloads.html
...
https://www.youtube.com/watch?v=ocRigaj7hGQ
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
REMOT
remotely-or-automatically-stopping-your
more at www.thetechfirm.com
One of the advantages of installing Wireshark, is working with and learning the various command line utilities that come along with it. Programs like tshark and dumpcap allow you to capture from the command line. This gives the analyst a lot of flexibility in the field.
For example you might create a shortcut on a client’s desktop so they can capture packets for you. You can also create a batch file so the system starts capturing when it powered on, which is very helpful when I build remote capture devices.
Tshark and dumpcap can capture with specific parameters like ring buffers, filters, etc.
One popular question I get asked is how to stop dumpcap or tshark after you start it. Normally you would press Ctrl+C to stop the capture. I have to admit that the solution I came up with is not very elegant, but works.
read the full article at
https://www.lovemytool.com/blog/tony-fortunato/ when its posted
...
https://www.youtube.com/watch?v=zTnICAwSDck
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
TESTI
testing-ubiquiti-s-5-port-edgerouter
Heres the amazon link to the router http://tinyurl.com/kgwm9ry
In my previous 2 videos (links) I share my methodology and results testing a Ubiquiti five port EdgePort router. The goal of these videos is to introduce you to a sample testing methodology and results. As I’ve mentioned previously throughput results are not static and will vary based on configuration, and tool used.
The NetScout Optiview XG uses UDP for its tests and I realized that I should perform a test using TCP to ensure that I covered that protocol. On your average network UDP isn’t typically used for file transfers, TCP is. Applications like FTP and Web browsers will use TCP. Thee a slight exception if you use Chrome and QUIC since it is all UDP.
You can read the rest of the article when its posted at;
http://www.networkcomputing.com/author-bio.asp?author_id=2332
...
https://www.youtube.com/watch?v=pyeQ5p1Pylo
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
INVES
investigating-loops
tons of more stuff at www.thetechfirm.com
Troubleshooting the most common “things are slow” complaint is one of the most difficult calls I get since there are many scenarios and variables to consider.
Root causes range from the malicious (like DDOS or viruses) to the unintentional (like equipment misconfigurations), and everything in between.
I found the most effective approach is trying to eliminate the possible root causes that are easy to prove or disprove. For example, starting up your protocol analyzer of choice connected to any port on the client VLAN could identify layer 2 loops, devices sending out a lot of broadcast multicast packets and misconfigured load balancing.
In this example, when I got the call and performed this check, I got lucky and there it was a layer 2 loop. Many analysts skip this check because they rely on Spanning Tree or Rapid Spanning Tree to prevent this from happening.
In the video below I walk you through how I figured this out and what the issue was.
Enjoy
...
https://www.youtube.com/watch?v=SwlScMZ2umY
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
SIMUL
simulating-bandwidth-and-packet-loss
Vmware Player Emulation Tip
When I’m asked to baseline or troubleshoot an application, the topic of how the application will behave at remote sites comes up.
Some people make the mistake of testing an application in the lab and expecting the same performance in the field for remote sites. The problem with that approach is that the real world has variables you can’t account for in the lab. For example there is packet loss and different bandwidth for remote sites.
When I get advance notice, I will bring my WAN emulator along. But in this case the client sprung this on me while troubleshooting and baselining. Luckily they were using VMWARE Workstation so we can use the Vmware Player (http://tinyurl.com/y97njgfm).
I showed them that in the Network adapter settings, they can modify the bandwidth and packet loss parameters to emulate the network conditions they expect.
read the rest when its posted
...
https://www.youtube.com/watch?v=gwlzLsvnW40
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
DUMPC
dumpcapui-utility-helps-out
I always like to provide alternatives to everyday tasks.
I get a lot of requests to spend some time showing people how to do as much as possible from the command line. Unfortunately people soon realize that if you don’t do it often enough the command line options and syntax quickly slips out of your memory and it becomes a frustrating exercise.
I while ago I introduced people to this neat little utility called dumpcapui (https://www.netskillz.com/dumpcapui/) it simply creates the command line syntax based on what you want dumpcap to do. FYI. many of the dumpcap options are the same as tshark, so feel free to experiment.
...
https://www.youtube.com/watch?v=bfvnWcCdZ6M
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English
Controlling
VIDEO
UPDAT
updating-npcap
For those of you who are not aware, this is worth covering.
As of Wireshark 3.0 for Windows, Winpcap is replaced with npcap.
The first thing to check is that if you do not have any other applications that rely on Winpcap, make sure it is removed by checking under you installed programs section in your control panel. If you are not sure, then you probably don’t need it. Those who use other winpcap applications will know if its required.
On to npcap. I ran into an issue where a client was having some really weird behavior with Wireshark 3.0. Its important to note that this computer has never had issues with previous versions of Wireshark/WinPcap.
First thing I checked was to ensure that his work laptop doesn’t have any endpoint software or configuration that would interfere with the installation process. After confirming this, I focused on npcap since he would open trace files without issue.
I went to https://nmap.org/npcap and noticed the current version was different than the version that Wireshark installed. I figured I have nothing to lose, so we manually unins.........
Read the full free article at NetworkDataPedia Blog: https://www.networkdatapedia.com/knowledge-hub/author/Tony-Fortunato
when its posted
...
https://www.youtube.com/watch?v=mNoXxipWSKk
Transaction
Created
2 weeks ago
Content Type
Language
video/mp4
English