0

CDP Discovery Using Microsoft’s PKTMON

In this video, I review how to use Microsoft pktmon commands to figure out what port I am connected to without using Wireshark.

0

Technical Debt or Underperforming Investment?

In this week’s issue of the Packet Pushers Human Infrastructure newsletter, there was an excellent blog post from Kam Lasater about how talking about technical debt makes us sound silly. I recommend you read the whole thing because he brings up some very valid points about how the way the other departments of the organization perceive our issues can vary. It also breaks down debt in a very simple format that takes it away from a negative connotation and shows how debt can be a leverage instrument.

To that end, I want to make a modest proposal to help the organization understand the challenges that IT faces with older systems and integration challenges. Except we need some new branding. So, I propose we start referring to technical debt as “underperforming technical investments”.

I’d Buy That For A Dollar

Technical debt is just a clever way to refer to the series of layered challenges we face from decisions that were made to accomplish tasks. It’s a burden we carry negatively throughout the execution of our job because it adds extra time to the process. We express it as debt because it’s a price that must be paid every time we need Continue reading

0

Detecting Magecart-Style Attacks With Page Shield

During CIO week we announced the general availability of our client-side security product, Page Shield. Page Shield protects websites’ end users from client-side attacks that target vulnerable JavaScript dependencies in order to run malicious code in the victim’s browser. One of the biggest client-side threats is the exfiltration of sensitive user data to an attacker-controlled domain (known as a Magecart-style attack). This kind of attack has impacted large organizations like British Airways and Ticketmaster, resulting in substantial GDPR fines in both cases. Today we are sharing details of how we detect these types of attacks and how we’re going to be developing the product into the future.

How does a Magecart-style attack work?

Magecart-style attacks are generally quite simple, involving just two stages. First, an attacker finds a way to compromise one of the JavaScript files running on the victim’s website. The attacker then inserts malicious code which reads personally identifiable information (PII) being entered by the site’s users, and exfiltrates it to an attacker-controlled domain. This is illustrated in the diagram below.

Magecart-style attacks are of particular concern to online retailers with users entering credit card details on the checkout page. Forms for online banking are also high-value Continue reading

0

How to use the expand command: 2-Minute Linux Tips

In this Linux tip, we’re going to look at the expand command. It's used to replace tabs in text files with space characters (sometimes referred to as "blanks").

0

netsim-tools on the Modem Podcast

A few weeks ago, Nick Buraglio and Chris Cummings invited me for an hour-long chat about netsim-tools on the Modem Podcast.

We talked about why one might want to use netsim-tools instead of another lab orchestration solution and the high-level functionality offered by the tool. Nick particularly loved its IPAM features which got so extensive in the meantime that I had to write a full-blown addressing tutorial. But there’s so much more: you can also get a fully configured OSPFv2, OSPFv3, EIGRP, IS-IS, SRv6, or BGP lab built from more than a dozen different devices. In short (as Nick and Chris said): you can use netsim-tools to make labbing less miserable.

0

Using the Linux host command to dig out DNS details

The host command on Linux systems can look up a variety of information available through the Domain Name System (DNS). It can find a host name if given an IP address or an IP address if given a host name plus a lot of other interesting details on systems and internet domains.The first query below tells us that the system associated with the address 192.168.0.18 is named “dragonfly”. The second tells us that 192.168.0.1 is the default router.$ host 192.168.0.18 18.0.168.192.in-addr.arpa domain name pointer dragonfly. $ host 192.168.0.1 1.0.168.192.in-addr.arpa domain name pointer router. To do the reverse, you can use commands like these:To read this article in full, please click here

0

Using the Linux host command to dig out DNS details

The host command on Linux systems can look up a variety of information available through the Domain Name System (DNS). It can find a host name if given an IP address or an IP address if given a host name plus a lot of other interesting details on systems and internet domains.The first query below tells us that the system associated with the address 192.168.0.18 is named “dragonfly”. The second tells us that 192.168.0.1 is the default router.$ host 192.168.0.18 18.0.168.192.in-addr.arpa domain name pointer dragonfly. $ host 192.168.0.1 1.0.168.192.in-addr.arpa domain name pointer router. To do the reverse, you can use commands like these:To read this article in full, please click here

0

Calico Cloud: Active Build and Runtime Security for Cloud-Native Applications

Calico Cloud has just celebrated its 1-year anniversary! And what better way to celebrate than to launch new features and capabilities that help users address their most urgent cloud security needs.

Over the past year, the Tigera team has seen rapid adoption of Calico Cloud for security and observability of cloud-native applications. With this new release, Calico Cloud becomes the first in the industry to offer the most comprehensive active cloud-native application security that goes beyond detecting threats to limit exposure and automatically mitigate risks in real time.

With news of new zero-day threats emerging almost every day (e.g. Argo CD, Chrome Browser), the current security approach needs to evolve. We need active build, deploy, and runtime security, all together, instead of using a siloed approach. Security threats, vulnerabilities, and risks for all three areas should be addressed together, by the same security platform, rather than using multiple disjointed tools. Calico Cloud does just that!

With Calico Cloud, you can reduce your cloud-native application’s attack surface, harness machine learning to combat runtime security risks from known and unknown zero-day threats, enable continuous compliance, and prioritize and mitigate the risks from vulnerabilities and attacks.

Let’s take a look Continue reading

0

Production ready eBPF, or how we fixed the BSD socket API

As we develop new products, we often push our operating system - Linux - beyond what is commonly possible. A common theme has been relying on eBPF to build technology that would otherwise have required modifying the kernel. For example, we’ve built DDoS mitigation and a load balancer and use it to monitor our fleet of servers.

This software usually consists of a small-ish eBPF program written in C, executed in the context of the kernel, and a larger user space component that loads the eBPF into the kernel and manages its lifecycle. We’ve found that the ratio of eBPF code to userspace code differs by an order of magnitude or more. We want to shed some light on the issues that a developer has to tackle when dealing with eBPF and present our solutions for building rock-solid production ready applications which contain eBPF.

For this purpose we are open sourcing the production tooling we’ve built for the sk_lookup hook we contributed to the Linux kernel, called tubular. It exists because we’ve outgrown the BSD sockets API. To deliver some products we need features that are just not possible using the standard API.

• Our services are available on millions of Continue reading

0

Combating Increased Complexity

Organizations need an enterprise-wide data and observability strategy, and standardization of visibility to combat the complexity of the digital world.

0

DEVASC Study Resources and Plan

0

How to Pass DEVASC

0

What is DEVASC

0

Who is squatting IPv4 addresses?

Who is squatting IPv4 addresses?

It’s an established fact on the internet that we have ran out of IP(v4) addresses, and we are st

0

Who is Squatting IPv4 addresses?

Who is Squatting IPv4 addresses?

It’s an established fact on the internet that we have ran out of IP(v4) addresses, and we are st

0

The Impact of Jumbo Maximum Frame Size on Data Center Switches

Sander Steffann sent me an intriguing question a long while ago:

I was wondering if there are any downsides to setting “system mtu jumbo 9198” by default on every switch? I mean, if all connected devices have MTU 1500 they won’t notice that the switch could support longer frames, right?

That’s absolutely correct, and unless the end hosts get into UDP fights things will always work out (aka TCP MSS saves the day)… but there must be a reason switching vendors don’t use maximum frame sizes larger than 1514 by default (Cumulus Linux seems to be an exception, and according to Sébastien Keller Arista’s default maximum frame size is between 9214 and 10178 depending on the platform).

0

CIsco faces a $14B backlog thanks to component scarcity

Cisco, like many of its competitors, has found increased revenue from pent-up demand, but chip shortages and other supply constraints continue to loom large over the industry.“We remain one of the largest software companies in the world,” Cisco CEO Chuck Robbins told investment analysts on an earnings call for its fiscal second quarter ended in January. "In Q2, our software revenue grew by 6% to $3.8 billion, total subscription revenue accelerated to $5.5 billion, up 7% year over year."To read this article in full, please click here

0

Cisco faces a $14B backlog thanks to component scarcity

Cisco, like many of its competitors, has found increased revenue from pent-up demand, but chip shortages and other supply constraints continue to loom large over the industry.“We remain one of the largest software companies in the world,” Cisco CEO Chuck Robbins told investment analysts on an earnings call for its fiscal second quarter ended in January. "In Q2, our software revenue grew by 6% to $3.8 billion, total subscription revenue accelerated to $5.5 billion, up 7% year over year."To read this article in full, please click here

0

Data-center spending is half that of cloud services

Spending on cloud services reached a total of $178 billion in 2021, a 37% increase over the $130 billion spent in 2020 and twice the amount enterprises are spending on their data centers, according to Synergy Research Group. For the fourth quarter of 2021, total cloud spending was $50.5 billion.When the COVID-19 pandemic hit in 2020, it drove a major shift in worldwide IT operational and spending to the cloud as company shifted to working from home. That trend is only continuing, even with the pandemic tapering off and companies calling people back into the office.John Dinsdale, principal analyst with Synergy, said he expects the cloud market to continue to grow at the considerable pace. “There is absolutely no doubt that the cloud market will continue to grow rapidly. That is an environment in which leading cloud providers ought to be able to continue aggressively growing their revenues,” he said via email.To read this article in full, please click here

0

How To Pass Environment Variables To A Remote SSH Deployment With PyCharm

I pass access tokens, authentication keys, and other secrets to Python scripts via environment variables rather than encode these values into the scripts themselves. If I was a real boy, I’d use a solution like Hashicorp Vault or other secrets management tool (there’s a bunch of them), but I haven’t yet found the motivation to learn such a tool.

I’m not sure I’d want to build and maintain such a tool if I did find the motivation. I’m sort of lazy sometimes is what I’m saying. So for now, environment variables it is.

PyCharm allows for the passing of environment variables from the IDE to a script, whether that script is running locally or in a remote SSH deployment you’ve configured for your project.

To set the environment variables, select Edit Configurations from the Run menu.

Or in the project bar above the code window, click the dropdown with your script name, and select Edit Configurations.

Either way brings up the following configuration window for the scripts in your project. In the Environment variables: field, click the icon.

That will bring up the following window you can use to configure the environment variables.

Fantastic. But how do we assign the Continue reading