<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>chrisbrenton.org &#187; 2-alert</title>
	<atom:link href="http://www.chrisbrenton.org/category/infocon-level/2-alert/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.chrisbrenton.org</link>
	<description>Your source for invisible security bug spray</description>
	<lastBuildDate>Mon, 22 Aug 2011 01:04:58 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=</generator>
		<item>
		<title>TCP Options Challenge &#8211; clues</title>
		<link>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/</link>
		<comments>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/#comments</comments>
		<pubDate>Wed, 18 Nov 2009 21:46:27 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=659</guid>
		<description><![CDATA[Earlier I posted a challenge to write a tcpdump/Windump filter that would capture packets that have the TCP option &#8220;Window Scale&#8221; set. Some folks are close, but I wanted to post a few hints. Also, I have no problem with you e-mailing me directly, but to win the challenge you have to post the answer [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>TCP Options Challenge</title>
		<link>http://www.chrisbrenton.org/2009/11/tcp-options-challenge/</link>
		<comments>http://www.chrisbrenton.org/2009/11/tcp-options-challenge/#comments</comments>
		<pubDate>Wed, 18 Nov 2009 15:59:34 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=650</guid>
		<description><![CDATA[I&#8217;ve had a bit going on including the release of a new reference tool for the Apple iPhone and iPod. The tool is call Packet Decode and I&#8217;ve setup an alternate site to help maintain it. I feel bad at neglecting this site over the last few weeks, so I&#8217;ve decided to throw out another [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/tcp-options-challenge/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Tshark Challenge – Uber-geek Answer</title>
		<link>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/</link>
		<comments>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/#comments</comments>
		<pubDate>Tue, 13 Oct 2009 09:52:24 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=631</guid>
		<description><![CDATA[In my last post I left you with a question: Given what we have seen in the decode file with tshark, what impact (if any) would there be if we place a stateful inspection firewall between the attacker and the Web server? In other words, if the attacker is running a packet sniffer, would they [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Tshark Challenge – The Final Answers</title>
		<link>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-the-final-answers/</link>
		<comments>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-the-final-answers/#comments</comments>
		<pubDate>Fri, 09 Oct 2009 09:57:22 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=628</guid>
		<description><![CDATA[In my last post we had determined that the trace file contained a session where a single honed network based intrusion prevention system had attempted to stop an attack from an HTTP client to a Web server. We concluded that the client’s data request did look rather suspicious, and proved a third party system (the [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-the-final-answers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Tshark Challenge – Hints 4</title>
		<link>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-hints-4/</link>
		<comments>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-hints-4/#comments</comments>
		<pubDate>Thu, 08 Oct 2009 16:21:19 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=613</guid>
		<description><![CDATA[In my last post we identified that the client system was probably running some kind of tool to probe for known to be vulnerable files. We still have to explain the reset packets however, as well as why the server was ignoring them. Right now we don’t even know where this packet capture was taken [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-hints-4/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Analyzing packets with tshark</title>
		<link>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/</link>
		<comments>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/#comments</comments>
		<pubDate>Thu, 01 Oct 2009 16:00:32 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=577</guid>
		<description><![CDATA[In an earlier post I discussed how to adjust the display output in tshark. The post generated a lot of interest, so I decided to add some additional information on using tshark to decode packets. This post assumes you have read the one linked to above. Why use tshark instead of tcpdump/windump? Many old time [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Passively Fingerprinting VMware Virtual Systems</title>
		<link>http://www.chrisbrenton.org/2009/09/passively-fingerprinting-vmware-virtual-systems/</link>
		<comments>http://www.chrisbrenton.org/2009/09/passively-fingerprinting-vmware-virtual-systems/#comments</comments>
		<pubDate>Tue, 15 Sep 2009 10:47:30 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[passive fingerprinting]]></category>
		<category><![CDATA[vmware]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=539</guid>
		<description><![CDATA[There have been some excellent papers written on how to detect if an operating system is running as a Vmware guest image. Automated tools have even been released to help expedite the process. All assume however that terminal or command prompt access is required to perform the detection. Few people realize that it is possible [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/09/passively-fingerprinting-vmware-virtual-systems/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Hiding A Backdoor Behind An Active Windows Listening Port</title>
		<link>http://www.chrisbrenton.org/2009/09/hiding-a-backdoor-behind-an-active-windows-listening-port/</link>
		<comments>http://www.chrisbrenton.org/2009/09/hiding-a-backdoor-behind-an-active-windows-listening-port/#comments</comments>
		<pubDate>Thu, 03 Sep 2009 09:56:54 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Windows Security]]></category>
		<category><![CDATA[listening ports]]></category>
		<category><![CDATA[netcat]]></category>
		<category><![CDATA[Windows security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=518</guid>
		<description><![CDATA[Its a common technique. You suspect one of your systems has been compromised, so you run a port scanner against the system. The hope is that if the system is backdoored you will identify an undocumented listening port. But what if a clever attacker hides the backdoor in plain site? What if they hide the [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/09/hiding-a-backdoor-behind-an-active-windows-listening-port/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Spoofing Your IP Address During A Port Scan – Part 2</title>
		<link>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/</link>
		<comments>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/#comments</comments>
		<pubDate>Mon, 31 Aug 2009 09:55:46 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[ip spoofing]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[packet crafting]]></category>
		<category><![CDATA[port scanning]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=506</guid>
		<description><![CDATA[In my last post I discussed an idle scan and how it can permit an attacker to mask their IP address during a port scan. In this installment we’ll look at some traces, as well as discuss how to identify when an idle scan has been used against your network. Monitoring the IP ID increment [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Mapping Through A Firewall &#8211; Part 3</title>
		<link>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/</link>
		<comments>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 09:56:25 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=494</guid>
		<description><![CDATA[In my last two posts I talked about two different methods that can be used to map a network through a firewall. The first leveraged ICMP time exceeded in transit errors, while the second used the IP record route option. In both posts I also gave possible solutions for preventing an attacker from using these [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

