How to Use sslscan: Check TLS Versions and Ciphers (with Examples)
sslscan found an IOS XE WebUI accepting only TLS 1.0 with AES-CBC-SHA. Two ip http commands left TLS 1.2/1.3 with five ECDHE suites, compared with sslyze and nmap.
Archive
Latest posts
How to Use tcpreplay: Replay a pcap Into an IDS Without Losing Packets
2,000 HTTP requests replayed into Suricata: 2,000 of 2,000 alerts up to 40,000 pps. At --topspeed, tcpreplay said 24,308 successful and Suricata said 0.00% drops, yet only 22,650 packets arrived and 1,605 alerts fired. Commands, output and the fix.
How to Use arpwatch: Catch Duplicate IPs and Flip Flops on a Switched LAN
Two hosts on 192.0.2.20. On an access port arpwatch logged nothing while the requester cached the impostor 5 of 6 times. On a SPAN port the same 6 lookups produced 9 flip flop reports. Install, service setup, every report message, and exact errors.
fping Command: Ping a Subnet or Range, and the Policer That Faked 40% Loss
fping -g sweeps a /24 in seconds. Through a 64 kbps ICMP policer, its 10 ms default interval reported 20% to 40% loss on 13 of 21 healthy hosts while the router counted 203 drops. At -i 20: 0% loss, 0 drops. Commands, output and the math.
How to Use masscan: Commands, --rate and masscan vs nmap Through a Policer
Through a 200 kbps policer, masscan at --rate 300 found all 64 open ports and at --rate 1000 only 21, because masscan never resends a dropped SYN. nmap -T4 found all 64 in 16 seconds. Commands, output and how to size the rate to the path.
How to Use hping3: Commands, Examples and One SYN With Four Answers
One SYN, four answers: SYN-ACK, RST, ICMP 3/13 from the router, or nothing. I ran hping3 against an IOS XE ACL, found the deny with the router's own unreachables and counters, and hit IOS's 500 ms rate limit: 20 probes, 4 answers.
How to Use Wireshark: Filters, Expert Info and a 1% Loss Test That Matched 145 Drops
1% loss dropped 145 segments of a 20 MB download. Wireshark at the client flagged 144 gaps, a capture upstream of the drop counted exactly 145 retransmissions, and the download went from 0.53 s to 26.04 s. Capture, filter and read it step by step.
Checkmk Community REST API Lab: An Automation User Adds 24 Hosts
A least-privilege automation user created 24 hosts through the Checkmk Community 2.5.0p18 REST API; official MCP is not in this edition. Interface 3, the provider A link, went CRITICAL 38 seconds after a shutdown once SNMP helper timeouts were fixed.
Nagios Core DOWN vs UNREACHABLE: Parent Hosts and Two WAN Failure Tests
With parents set, cutting branch 2 off both providers made the branch edge DOWN and its user UNREACHABLE. A provider A shutdown left every host UP and went HARD CRITICAL on a data-plane check 3 min 51 s later. Real object config and logs.
Cacti SNMPv3 Graphs for Cisco IOS-XE: What a Provider Link Failure Looks Like
Cacti 1.2.31 graphed 15 Cisco IOS-XE devices over SNMPv3. A 13-minute provider A shutdown showed as status 2 on one interface graph while the loopback-polled router kept polling. Config, rrdtool checks, and how 5-minute polls blur the edges.
Zabbix Cisco SNMPv3 Monitoring: Poll Loopback0 and Fix Interface Discovery
Zabbix 7.0 LTS on Cisco IOS-XE: polling Loopback0 turned a provider A shutdown into an interface-down problem 14 seconds later, instead of a dead-router alert after 2 minutes. Real SNMPv3 config, the ifName fix, and both test runs.
Cisco SD-WAN Upgrade Order: Manager, Validator, Controller, Then Edges
Upgrade Manager by itself, then the Validator, the Controller, and edges in waves. Record show software on every box first: in this 20.18.2.1 and 17.18.02 lab each role had exactly one image, active and default, with no previous version.