I inwardly smile when I hear the term “Unified Threat Management”. It means different things to different people, but to me it means consolidating the different “types” of security filtering, e.g.: ACLs Firewalling Stateful Inspection Deep Packet Inspection (whatever that is) Network Intrusion Detection Network Intrusion Prevention Application Security Filtering (Web, Database, etc.) …onto a single device. This…
Capturing Traffic Once and Making That Traffic Available to Multiple Tools
I’ve been obsessed with an idea for a while now of a networking and security tool that captures network data once and makes that data available to any kind of tool that asks for it. It’s not my idea; an buddy of mine named Eric, who I’ve since lost touch with, told me about it over lunch at…
Port Mirroring on a Cisco 3550 Switch
Just for reference… Source port(s): Switch# config t Switch(config)# monitor session 1 source interface fastethernet 0/1 Switch(config)# monitor session 1 source interface fastethernet 0/2 Switch(config)# monitor session 1 source interface fastethernet 0/3 Switch(config)# monitor session 1 source interface fastethernet 0/4 (however many you want to monitor) Destination port: Switch(config)# monitor session 1 destination interface fastethernet 0/24 …then exit…
Security: How Network Ports Work
Many who are new to networking and security wonder what it means to have “ports” open on your computer. Some get rather anxious when an online port scan reveals that something’s open on their system. What follows is a silly, but hopefully memorable way for beginners to remember how nework ports work. Houses, Windows, and Midgets Imagine a…
My First 2600 Meeting
Last Friday I went to my first 2600 meeting. It was, of course, here in New York City — home of the original meetings. The group started small and grew to around 40, which the regulars said was a weak showing. We pushed through the awkwardness (which wasn’t helped by our being dressed in business attire) and were…