Network Traffic Capture in Virtual Environments
This post demonstrates how to mirror interfaces on a virtual private server (VPS) in a cloud environment, e.g. virtual machine (VM) on a hypervisor where you …
Security · Architecture · Network Defense
Hello. I’m Stephen.
I use this site to post useful notes, field lessons, and random technical wanderings that make computing and information security a little easier.
Latest articles
View allNetwork Traffic Capture on Linux using OpenvSwitch
This post demonstrates how you can mirror interfaces on a Linux server in an environment where you may not have physical network taps or SPAN ports. We can u…
Benchmarking Websites with ab and tsung
Everyone appreciates a responsive website, and because I host several, I am always looking for ways to improve their performance. Previously, I was interested in, HTTP, HTTPS, and HTTP…
Detecting Tor traffic with Bro network traffic analyzer
This article is part of a series on identifying Tor network traffic with the Bro Network Security Monitor, now known as Zeek. This post is not to argue the merits of allowing Tor to run on a network…
SiLK Network Traffic Analysis Visualization with R and Rayon
In this post, the process for retroactively identifying and graphing an HTTPS DDoS of service condition is described. Why do we care about graphing, because i…
Graphing Namebench Spreadsheet Data with R
In the previous post, I described the process of benchmarking domain name servers for a website domain with a modified version of Namebench. Namebench genera…