Containerlab Packet Capture: Save show Output and a pcap
Built in my home lab: one script pulls show output from an IOL console, captures a ping in the client's network namespace, redacts management IPs, then cleans up.
Packet Analysis
Reading what actually crossed the wire. Articles tagged Packet Analysis cover capture points, filters, and decoding protocol exchanges frame by frame.
Latest posts
Zeek Rogue DHCP and ARP Spoofing Detection: Why SPAN Matters
Built in my home lab: a 51-line Zeek script flags rogue DHCP and gateway ARP spoofing, but only after SPAN sends it the unicast attack frames.
Suricata Inline IPS with NFQUEUE Between Cisco IOL Routers
Built in my home lab: Suricata on NFQUEUE between two Cisco IOL routers drops one test datagram, and pcaps, EVE and the NFQ verdict count prove it.
Zeek Across ASA PAT: Match Inside and Outside conn.log Flows
Built in my home lab: two Zeek sensors either side of an ASA, six HTTP flows matched through show xlate, and an ASA clock skew that broke a time-window join.
Community ID: Correlate Zeek and Suricata Logs from One PCAP
Join an alert to a successful HTTP request in one capture. Test a Community ID seed mismatch and reconcile DNS counts and byte units.
Suricata eve.json Alerts: Trace an Nmap Scan to the Rule
Replay a bounded scan with one explicit Suricata rule. Follow EVE alerts to packets, compare an empty-rule run, and explain a benign alert.
Analyze a PCAP with Zeek: Read conn.log, dns.log, http.log
Build a known capture, process it with Zeek, and follow connection UIDs through DNS and HTTP results. Check the records against the packets.
DNS over TLS vs DNS over HTTPS: Test Both with kdig
Query one signed answer over four transports, test certificate identity and DoH paths, then carry a DNSSEC-bogus answer over verified TLS.
IPv6 Packet Too Big: Why TCP Uploads Stall and How to Fix It
Small requests pass while a 64 KiB upload stalls at a 1280-byte link. Restore Packet Too Big feedback and see how a cached PMTU hides the fault.
Linux Firewall Allows TCP but It Fails: Route, Listener, NAT
Reproduce a missing route, stopped listener, loopback binding, and later firewall drop. Choose the next check from the packet’s last known point.
Conntrack and SNAT: Fix a Stale NAT Entry Without a Flush
Keep one session open while changing SNAT. Compare original and reply tuples, reproduce stale no-translation state, and repair one flow.
Cisco ACL Packet Drop: Trace It with Linux Packet Captures
Follow four echo requests from Linux into Cisco IOL, find an outbound ACL deny with captures and counters, then remove it and verify recovery.