<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>chrisbrenton.org &#187; Packet Decoding</title>
	<atom:link href="http://www.chrisbrenton.org/category/security/packet-decoding/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.chrisbrenton.org</link>
	<description>Your source for invisible security bug spray</description>
	<lastBuildDate>Mon, 22 Aug 2011 01:04:58 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=</generator>
		<item>
		<title>ICMPv6 Challenge &#8211; Answers</title>
		<link>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-answers/</link>
		<comments>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-answers/#comments</comments>
		<pubDate>Sun, 13 Dec 2009 11:52:03 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=746</guid>
		<description><![CDATA[The challenge was: “Write a tcpdump/windump filter that will capture ICMPv6 Multicast Listener packets.” I have an extensive write up on what makes the answer so complex. If you know IPv6 and just want the answer, skip to the end. First, Some Background Steinar made some comments to the previous posts and was 100% on [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-answers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>IP Lookup Completed</title>
		<link>http://www.chrisbrenton.org/2009/12/ip-lookup-completed/</link>
		<comments>http://www.chrisbrenton.org/2009/12/ip-lookup-completed/#comments</comments>
		<pubDate>Thu, 10 Dec 2009 15:21:31 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[1-emerg]]></category>
		<category><![CDATA[Packet Decoding]]></category>
		<category><![CDATA[TCP and UDP port list]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=738</guid>
		<description><![CDATA[Just finished a new tool called IP Lookup that I&#8217;ve submitted to the Apple App store. With any luck it will see the light of day over the next week or so. I know, there are plenty of TCP/UDP port references out there. I&#8217;ve tried to make this the most complete list available. There are [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/ip-lookup-completed/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ICMPv6 Challenge &#8211; Hints</title>
		<link>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-hints/</link>
		<comments>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-hints/#comments</comments>
		<pubDate>Wed, 09 Dec 2009 05:36:04 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=732</guid>
		<description><![CDATA[OK, here&#8217;s a hint to point you in the right direction. The challenge was: &#8220;Write a tcpdump/windump filter that will capture ICMPv6 Multicast Listener packets.&#8221; Sounds easy, right? With a little help from Google you&#8217;ll find that the &#8220;type&#8221; for Multicast listener is 130, and the ICMPv6 type field is the first byte in the [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/icmpv6-challenge-hints/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>ICMPv6 Challenge</title>
		<link>http://www.chrisbrenton.org/2009/12/icmpv6-challenge/</link>
		<comments>http://www.chrisbrenton.org/2009/12/icmpv6-challenge/#comments</comments>
		<pubDate>Sat, 05 Dec 2009 01:07:40 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=726</guid>
		<description><![CDATA[Building on the IPv6 challenge from last time, I have a new one for you: Write a tcpdump/windump filter which will capture ICMPv6 Multicast Listener packets. That&#8217;s it! Pretty easy, right?]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/icmpv6-challenge/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Weekend Challenge &#8211; Answers</title>
		<link>http://www.chrisbrenton.org/2009/12/weekend-challenge-answers/</link>
		<comments>http://www.chrisbrenton.org/2009/12/weekend-challenge-answers/#comments</comments>
		<pubDate>Thu, 03 Dec 2009 17:01:20 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=722</guid>
		<description><![CDATA[Well its now Thursday so I figured its time to post the answers to last weekend&#8217;s challenge. First, why should you even care about IPv6 if you have not started deploying it? I felt much the same way till I found IPv6 being used as a covert communication channel within a client&#8217;s network. The data [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/weekend-challenge-answers/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Weekend Challenge &#8211; Hint</title>
		<link>http://www.chrisbrenton.org/2009/12/weekend-challenge-hint/</link>
		<comments>http://www.chrisbrenton.org/2009/12/weekend-challenge-hint/#comments</comments>
		<pubDate>Tue, 01 Dec 2009 15:20:25 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=708</guid>
		<description><![CDATA[Wow, the sound of crickets is deafening. Surely someone has the skills to get us through this dilemma?  OK, some hints to get you through the challenge. Let&#8217;s start by solving this as an IPv4 address and then we&#8217;ll work our way into IPv6. Assume the address range we want to capture is 192.168.1.10 &#8211; [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/12/weekend-challenge-hint/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Weekend Challenge</title>
		<link>http://www.chrisbrenton.org/2009/11/weekend-challenge/</link>
		<comments>http://www.chrisbrenton.org/2009/11/weekend-challenge/#comments</comments>
		<pubDate>Fri, 27 Nov 2009 10:20:51 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=700</guid>
		<description><![CDATA[Here&#8217;s another challenge to test your bit wienie skills: Write a tcpdump or Windump filter that will capture all traffic with a source IPv6 address of 2001:db8::10 through 2001:db8::20. Pretty easy, right? If you have not tried it, your going to find that tcpdump/Windump throws a few curves at you. To check your work, here&#8217;s [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/weekend-challenge/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Oh where, oh where can WScale be?</title>
		<link>http://www.chrisbrenton.org/2009/11/oh-where-oh-where-can-wscale-be/</link>
		<comments>http://www.chrisbrenton.org/2009/11/oh-where-oh-where-can-wscale-be/#comments</comments>
		<pubDate>Fri, 20 Nov 2009 11:39:54 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=669</guid>
		<description><![CDATA[If this challenge seemed harder than it should be,you are on the right track. I ran across this problem when writing my Packet Decode tool. I have to say, it was a cool exercise for me, as I never really thought about creating tcpdump and Wireshark filters for every possible IP, TCP, UDP and ICMP [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/oh-where-oh-where-can-wscale-be/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>TCP Options &#8211; Final clue</title>
		<link>http://www.chrisbrenton.org/2009/11/tcp-options-final-clue/</link>
		<comments>http://www.chrisbrenton.org/2009/11/tcp-options-final-clue/#comments</comments>
		<pubDate>Thu, 19 Nov 2009 19:26:12 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[3-err]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=663</guid>
		<description><![CDATA[I&#8217;ve had one thread post and four e-mails that are soooooo close to the right answer. Here&#8217;s one last clue to hopefully get folks over the final hurdle. I mentioned the helpful tshark command. Here&#8217;s the output: C:\testing&#62;tshark -n -r linux-syn.cap -T fields -e tcp.options 02:04:05:b4:04:02:08:0a:02:47:4a:a8:00:00:00:00:01:03:03:05 So what you have above is the TCP options [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/tcp-options-final-clue/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>TCP Options Challenge &#8211; clues</title>
		<link>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/</link>
		<comments>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/#comments</comments>
		<pubDate>Wed, 18 Nov 2009 21:46:27 +0000</pubDate>
		<dc:creator>Chris</dc:creator>
				<category><![CDATA[2-alert]]></category>
		<category><![CDATA[Packet Decoding]]></category>

		<guid isPermaLink="false">http://www.chrisbrenton.org/?p=659</guid>
		<description><![CDATA[Earlier I posted a challenge to write a tcpdump/Windump filter that would capture packets that have the TCP option &#8220;Window Scale&#8221; set. Some folks are close, but I wanted to post a few hints. Also, I have no problem with you e-mailing me directly, but to win the challenge you have to post the answer [...]]]></description>
		<wfw:commentRss>http://www.chrisbrenton.org/2009/11/tcp-options-challenge-clues/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

