Hardening the network you already run. Articles tagged Network Security cover control-plane protection, access control, segmentation, and the attacks each countermeasure is actually stopping.
ND Inspection, IPv6 Snooping, and IPv6 Source Guard stop address spoofing that RA Guard cannot see. This covers how the device-tracking binding table learns which IPv6 address belongs on which port and how the switch enforces it.
Any device on an IPv6 segment can send a Router Advertisement and reconfigure every host's default gateway. This post configures RA Guard and DHCPv6 Guard, then floods rogue RAs to prove the switch blocks them.
uRPF asks one question of every arriving packet: do I have a route back to this source? Configure strict mode on IOS XE, fire spoofed packets at the router, and count the drops, then see where loose mode fits instead.
A traffic flood aimed at the router's own CPU can drop OSPF and BGP adjacencies without a single link failing. CoPP is the seatbelt: a QoS policy on the control plane that rate-limits each traffic class.
Who logged in, what they could run, and who typed the command that broke the network. This article configures real AAA on Cisco IOS XE, authenticates a live login against RADIUS, shows the exchange on the wire, and compares TACACS+ vs RADIUS.
Harden the login prompt on Cisco IOS XE: the password-type hierarchy, minimum length enforcement, brute-force lockout, and where MFA fits, including a real brute-force attempt hitting a lab router.
Threat, vulnerability, exploit, mitigation: CCNA domain 5 hinges on keeping these terms straight. This article pins down each one, walks the attack categories the exam expects, and maps each attack to the Cisco technology that stops it.
Nmap's -oN, -oX, -oG, and -oA output formats, when each one earns its place, and the shell one-liners that turn a saved scan into an answer. Save scans you can diff week over week and hand to the audit team as evidence.
Nmap's timing templates -T0 through -T5 and its rate control flags decide whether a scan finishes fast or slips under an IDS. This guide shows when to push packets on a /16 sweep and when to trickle probes past a rate-based SIEM alert.
Nmap's evasion flags are your test harness: fragmentation, decoys, source-port tricks, and timing, run against your own firewall and IDS to prove your controls actually catch them. Real captures from a Cisco lab and the internet.
NSE turns Nmap from a port scanner into an inventory and audit tool: enumerate HTTP methods, list SSH algorithms, flag open directory listings. This post covers the script categories with real captured output.
Half your infrastructure runs on UDP: DNS, SNMP, NTP, DHCP. This guide covers how nmap -sU decides port states, how to read the ambiguous open|filtered results, which UDP services are worth scanning, and how to keep a scan from taking all night.