Zeek Rogue DHCP and ARP Spoofing Detection: Why SPAN Matters
Built in my home lab: a 51-line Zeek script flags rogue DHCP and gateway ARP spoofing, but only after SPAN sends it the unicast attack frames.
Blue Team
The defensive side of network security. Articles tagged Blue Team cover detecting an attack in progress, reading the logs and flow records it leaves behind, and hardening the box before the next one.
Latest posts
Suricata Inline IPS with NFQUEUE Between Cisco IOL Routers
Built in my home lab: Suricata on NFQUEUE between two Cisco IOL routers drops one test datagram, and pcaps, EVE and the NFQ verdict count prove it.
Suricata on a SPAN Port: Why the Wrong Mirror Direction Means No Alerts
Suricata shows no alerts during a port scan? Trace a SPAN direction fault through missing SYNs and EVE logs, then fix the mirror and verify recovery.
Detecting Nmap Scans: The View From the Defender's Side
The site already teaches you how to run every nmap scan. This one flips the camera around: what a SYN scan, a UDP scan and a ping sweep actually look like in an IOS XE ACL counter, in syslog and in a packet capture, plus why a slow scan beats most of it.