Suricata on a SPAN Port: Why the Wrong Mirror Direction Means No Alerts
Suricata shows no alerts during a port scan? Trace a SPAN direction fault through missing SYNs and EVE logs, then fix the mirror and verify recovery.
Jaime
Latest posts — page 7
Cisco Images in Containerlab: IOL, vIOS, ASAv, FTDv, N9Kv and 9800
Choose Cisco Containerlab images by lab: IOL, IOSv, ASAv, FTDv, N9Kv and C9800. Compare local tags, RAM, interfaces and verified limits.
DHCP Starvation and Rogue DHCP Server: A Snooping Lab
Exhaust a 12-address DHCP pool, observe a rogue gateway, fix an untrusted snooping uplink, and verify bindings, burst isolation, and rogue OFFER drops.
ICMP Ping Fails? Troubleshooting Lab: Timeouts, TTL and MTU
Follow ICMP ping troubleshooting steps through seven captured faults: timeouts, unreachables, ACLs, return routes, TTL loops, MTU and host firewalls.
STP Root Port Election Worked Example: Cost, Neighbor BID, and Port ID
Calculate root ports on six switches using cost, neighbor BID, and sender port ID. Check real outputs, then change one cost to move SW4’s root port.
Cisco Port Security vs MAC Flooding: Limit Learning, Fix Shutdowns
Test Cisco port security against MAC flooding: 17,991 learned entries, a three-MAC protected table, and a phone-plus-PC shutdown fixed with maximum 2.
Cisco IPsec Phase 1 Up, Phase 2 Down: Five IOL Lab Tests
Phase 1 up, Phase 2 down on Cisco? Diagnose four IOL VPN outages with real debug, NAT and ESP evidence, plus a lifetime mismatch that kept working.
802.1X Dynamic VLAN Assignment Not Working: FreeRADIUS Lab
Trace a FreeRADIUS VLAN typo from Access-Accept to an unauthorized Cisco port. Compare sessions, syslog, pings, and Zeek, then verify the fix.
802.1X Shared Secret Mismatch: A FreeRADIUS Lab
Reproduce one switch-side RADIUS key mismatch on IOSv-L2. Compare formal authorization, FreeRADIUS drops and captures on both links, then restore the key and verify EAP-TLS and bidirectional traffic.
ASA NAT Troubleshooting: Stale Manual NAT Overrides Static NAT
Fix an ASA static NAT publish hijacked by a stale manual rule. Follow packet-tracer, NAT hits, syslog 106023, and Zeek S0-to-SF recovery in this lab.
Running the Cisco Catalyst 9800-CL in Containerlab
A custom vrnetlab build for the Cisco 9800-CL, the console and management fixes it needed, and the checks that proved SSH and the web GUI worked.
Community ID: Correlate Zeek and Suricata Logs from One PCAP
Join an alert to a successful HTTP request in one capture. Test a Community ID seed mismatch and reconcile DNS counts and byte units.