Linux




'How to separate inbound and outbound data graphs in Nfsen Netflow tool '

As I said already ( here and here ) for gathering Netflow data, especially with security in mind, I deem Nfsen/nfdump to be the best. And with some easy 2-minutes tweaking I can always make it do exactly what I want. By default when you configure Cisco to export both ingress …



You can be Nmap hacker too - contribute new signatures in few easy steps and feel proud of yourself

NMAP is probably the most known long standing and community involved security-related project in the Open Source universe ever. And it is quite naturally to think that there is nothing left to be done to improve it by end users like us, and of course the opposite is the case …



Best open source Netflow/sFlow analyzing software

People ask me frequently what software I would recommend for Netflow analysis , especially with security implementations in mind. I made my choice a long ago and haven't been complaining so far - Nfsen graphical frontend that has Nfdump as its data processing backend . It provides most flexibility, configurability; its filter syntax …



Too much of the Zeus on TV

At 19th of October the 1st Russia channel aired the TV show called "Пусть говорят, Однажды в Америке" , dedicated to Zeus trojan story. You all saw and heard about this FBI operation that brought some 38 people to the captivity. The talk show on the most available and popular Russian …



Convert mb4 to mp3 files in one run with ffmpeg

Folks at Defcon.org have been somewhat inconsistent in publishing their conference audio archives - once they do it in mb4 format, once in mp3 . As I listen to them on my mobile phone during my commuting to the work and it doesn't accept anything but mp3 I had to first …



You need no MX record to get mails

That one is funny. One client of ours that is actually themselves provide ISP services in a far-far-away land asked to add PTR record for their mail server . But that was dull, the interesting part was that their domain had absolutely NO MX record ! Only A record for the mail …



Skynet got blacklisted - Google mail servers entered RBL of Sorbs.net

When yesterday my client sent me the headers of blocked by eSafe (Aladdin) mails I was quite surprised - the message said " Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this …



List of valid domain names for load testing DNS

I am currently running a bunch of tests on DNS resolver software called Unbound to see what it is worth and for that needed a list of valid domain names in different but controllable TLDs. The only resource to download such list I could find was 3 million records file …



Query non-standard port of SNMP with snmpwalk

Sometimes the simple things are the ones to perplex us the most . Today I needed to add an SNMP monitoring of the Radware Linkproof load balancer listening on the port 7777 . Not a big deal, I thought. But before doing it in the monitoring system I wanted to be sure …



MAC finder script

While I don't like going down to Layer 2 , recently I had to do it - I didn't know IP address of the Cisco router I wanted to connect to but I had access to the Cisco router sitting in the same network. That would be pretty easy to do #show …