<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>chrisbrenton.org &#187; Network Security</title>
	<atom:link href="http://www.chrisbrenton.org/category/security/network/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.chrisbrenton.org</link>
	<description>Your source for invisible security bug spray</description>
	<lastBuildDate>Mon, 22 Aug 2011 01:04:58 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=</generator>
		<item>
		<title>Tshark Challenge – Uber-geek Answer</title>
		<link>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/</link>
		<comments>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/#comments</comments>
		<pubDate>Tue, 13 Oct 2009 09:52:24 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=631</guid>
		<description><![CDATA[In my last post I left you with a question: Given what we have seen in the decode file with tshark, what impact (if any) would there be if we place a stateful inspection firewall between the attacker and the Web server? In other words, if the attacker is running a packet sniffer, would they [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/tshark-challenge-%e2%80%93-uber-geek-answer/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Analyzing packets with tshark</title>
		<link>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/</link>
		<comments>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/#comments</comments>
		<pubDate>Thu, 01 Oct 2009 16:00:32 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=577</guid>
		<description><![CDATA[In an earlier post I discussed how to adjust the display output in tshark. The post generated a lot of interest, so I decided to add some additional information on using tshark to decode packets. This post assumes you have read the one linked to above. Why use tshark instead of tcpdump/windump? Many old time [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/10/analyzing-packets-with-tshark/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How To Review A Firewall Log In 15 Min Or Less – Part 2</title>
		<link>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-min-or-less-%e2%80%93-part-2/</link>
		<comments>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-min-or-less-%e2%80%93-part-2/#comments</comments>
		<pubDate>Tue, 29 Sep 2009 16:50:57 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[batch files]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[log management]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=570</guid>
		<description><![CDATA[In my last post I introduced the concept of using white listing in order to review firewall logs. I discussed how this process can both simplify as well as expedite the log review process, by automating much of the up front work. In this post we will look at some actual examples, as well as [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-min-or-less-%e2%80%93-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How To Review A Firewall Log In 15 Min Or Less – Part 1</title>
		<link>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-minutes-or-less-%e2%80%93-part-1/</link>
		<comments>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-minutes-or-less-%e2%80%93-part-1/#comments</comments>
		<pubDate>Fri, 25 Sep 2009 14:22:38 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[batch files]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[log management]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=563</guid>
		<description><![CDATA[One of the most difficult and time consuming parts of maintaining a perimeter is reviewing firewall logs. It&#8217;s not uncommon for an organization to generate 50, 100, 500 MB or more worth of firewall log entries on a daily basis. The task is so daunting in fact, that many administrators choose to ignore their logs. [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/09/how-to-review-a-firewall-log-in-15-minutes-or-less-%e2%80%93-part-1/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Spoofing Your IP Address During A Port Scan – Part 2</title>
		<link>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/</link>
		<comments>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/#comments</comments>
		<pubDate>Mon, 31 Aug 2009 09:55:46 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[ip spoofing]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[packet crafting]]></category>
		<category><![CDATA[port scanning]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=506</guid>
		<description><![CDATA[In my last post I discussed an idle scan and how it can permit an attacker to mask their IP address during a port scan. In this installment we’ll look at some traces, as well as discuss how to identify when an idle scan has been used against your network. Monitoring the IP ID increment [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Spoofing Your IP Address During A Port Scan – Part 1</title>
		<link>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-1/</link>
		<comments>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-1/#comments</comments>
		<pubDate>Fri, 28 Aug 2009 13:06:08 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Windows Security]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[ip spoofing]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>
		<category><![CDATA[port scanning]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=499</guid>
		<description><![CDATA[I love debunking myths, one of my favorites is “a port scanner must reveal his true source IP address”. In this series I’ll show you how to perform a port scan while hiding your source IP address from the host being scanned. I’ll also tell you how you can detect the technique when it is [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/spoofing-your-ip-address-during-a-port-scan-%e2%80%93-part-1/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Mapping Through A Firewall &#8211; Part 3</title>
		<link>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/</link>
		<comments>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/#comments</comments>
		<pubDate>Wed, 26 Aug 2009 09:56:25 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=494</guid>
		<description><![CDATA[In my last two posts I talked about two different methods that can be used to map a network through a firewall. The first leveraged ICMP time exceeded in transit errors, while the second used the IP record route option. In both posts I also gave possible solutions for preventing an attacker from using these [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-3/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Mapping Through A Firewall &#8211; Part 2</title>
		<link>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-2/</link>
		<comments>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-2/#comments</comments>
		<pubDate>Tue, 25 Aug 2009 09:56:51 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=478</guid>
		<description><![CDATA[In my last post I discussed how to use ICMP time exceeded in transit errors to map a network perimeter. I also discussed how to prevent attackers from using this technique against your network. In this post I’ll discuss another network mapping technique using the record route IP header options. Ipv4 header options The IP [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Network Mapping Through A Firewall &#8211; Part 1</title>
		<link>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-1/</link>
		<comments>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-1/#comments</comments>
		<pubDate>Mon, 24 Aug 2009 09:57:43 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[network security]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=462</guid>
		<description><![CDATA[When we create a set of firewall rules, one of our objectives is usually to stop attackers on the Internet from being able to map the internal network sitting behind the firewall. In this write up I’ll discuss two different techniques which will let an attacker punch right though most firewall setups, and what additional [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/network-mapping-through-a-firewall-part-1/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Top 5 Firewall Threats &#8211; Part 2</title>
		<link>http://www.chrisbrenton.org/2009/08/top-5-firewall-threats-part-2/</link>
		<comments>http://www.chrisbrenton.org/2009/08/top-5-firewall-threats-part-2/#comments</comments>
		<pubDate>Mon, 03 Aug 2009 14:32:43 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[attack mitigation]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[perimeter security]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=320</guid>
		<description><![CDATA[In the last post I started counting down the five greatest threats to perimeter security. In this post I’ll complete the list. Firewall Threat #3: Outbound HTTP The popularity of HTTP (TCP/80) has become both a blessing and a tragedy. Certainly the Internet would not be as popular as it is today without the World [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/08/top-5-firewall-threats-part-2/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

