Suricata eve.json Alerts: Trace an Nmap Scan to the Rule
Replay a bounded scan with one explicit Suricata rule. Follow EVE alerts to packets, compare an empty-rule run, and explain a benign alert.
Jaime
Latest posts — page 8
Analyze a PCAP with Zeek: Read conn.log, dns.log, http.log
Build a known capture, process it with Zeek, and follow connection UIDs through DNS and HTTP results. Check the records against the packets.
DNS over TLS vs DNS over HTTPS: Test Both with kdig
Query one signed answer over four transports, test certificate identity and DoH paths, then carry a DNSSEC-bogus answer over verified TLS.
DNSSEC Broken Trust Chain: Debug a DS Mismatch with delv
Change one digit in a signed parent DS, follow delv to the failed child key check, and tell a bogus chain from an unsigned delegation.
mTLS Client Certificate Rejected? Debug It with OpenSSL
A trusted server can still reject its client. Reproduce three client-certificate failures, compare both sides of TLS, and verify recovery.
OpenSSL s_client: Debug SNI, Hostname, and Chain Errors
Keep the destination fixed while changing SNI, the expected hostname, and the chain. Verify each fault with strict OpenSSL checks.
IPv6 Packet Too Big: Why TCP Uploads Stall and How to Fix It
Small requests pass while a 64 KiB upload stalls at a 1280-byte link. Restore Packet Too Big feedback and see how a cached PMTU hides the fault.
Linux rp_filter: Diagnose Asymmetric Routing Packet Drops
A captured SYN can still fail source validation before local delivery. Compare strict and loose checks, then fix the route and keep strict mode.
Linux Firewall Allows TCP but It Fails: Route, Listener, NAT
Reproduce a missing route, stopped listener, loopback binding, and later firewall drop. Choose the next check from the packet’s last known point.
Conntrack and SNAT: Fix a Stale NAT Entry Without a Flush
Keep one session open while changing SNAT. Compare original and reply tuples, reproduce stale no-translation state, and repair one flow.
nft monitor trace: Find Which nftables Rule Drops a Packet
Follow one SYN through an allow and a later deny. Use a scoped nft trace, rule handles, and captures on both sides of an isolated Linux router.
arping: Detect a Duplicate IP Address or Proxy ARP on Linux
Two MACs can answer for one IP while ping still works. Capture the duplicate, repair it, and test a Linux proxy that answers ARP but not DAD.