JJoseph O'Shaughnessy7h ago · 11 min readDiagnosing DNS Failures with dig and tcpdump"It's always DNS" is a running joke for a reason. But "DNS is broken" covers a lot of very different problems: a name that doesn't exist, a server that's down, a firewall in the way, or a client askinjosephoshaughnessy.hashnode.dev
JJoseph O'ShaughnessyOct 18 · 12 min readFinding an MTU Black HoleYou can SSH to the server. The login page loads. Ping works. But the moment someone downloads a large file or opens a big report, it just sits there, and eventually times out. Everyone swears the netwjosephoshaughnessy.hashnode.dev
JJoseph O'ShaughnessyOct 18 · 12 min readDiagnosing a Failed TCP HandshakeWhen someone says "the application is down", the quickest way to settle whether it's the network is to look at the TCP handshake. If the three-way handshake never completes, the application never getsjosephoshaughnessy.hashnode.dev
Mmhk cyberOct 3 · 6 min readMy First Wireshark PCAP: Kongtuke Rebuke! So I decided to learn Wireshark. I watched like a 20minute video on YouTube, understood the basics, how to apply filters, conversations, endpoints, some of the protocols, etc. Nothing too crazy. Then mhk-cyber.hashnode.dev
JJebitokSep 22 · 10 min readPacked Light: Wireshark x Cryptography - XOR & Base64 - Forensics (TryHackMe)Link to the challenge on TryHackMe: Packed Light 🛎️ Concierge Briefing Tiny packets. Odd hours. Suspiciously regular. Someone's smuggling out the data equivalent of a hotel towel every night, foldedsharonjebitok.com
RRobin HayerSep 21 · 5 min readThe tool said it wrote 48 packets. Only 44 were thereRecap I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog postrobinhayer.hashnode.dev
PPreetimantSep 15 · 14 min readUnderstanding Modbus/TCP Through Packet Analysis — HTB Watch TowerWhile working through Hack The Box's ICS/SCADA track, I completed Watch Tower, an introductory packet-analysis lab built around Modbus/TCP traffic. The challenge itself was fairly short: a PCAP capturpreetimant.hashnode.dev
RRobin HayerAug 26 · 5 min readConcurrency Without a Parallel Parser: Splitting PCAPs by SessionWhere the last post left off In my first post about the 2.5 GB wall, streaming fixed memory. It didn't fix throughput. The pipeline was still one file, one tshark process, one core. Piping stdout to srobinhayer.hashnode.dev
YYogeshwar PeelaAug 10 · 35 min readTryHackMe : Overflow The Jackpot writeup# Challenge Category Flag 1 B1t Recovery Crypto THM{[REDACTED]} 2 Lost Fortune Included Web THM{REDACTED} 3 Casino Heist Forensics THM{REDACTED} 4 Fresh Powder - Bonus Challenge Detection Eng1exploitnotes.hashnode.dev
RRobin HayerAug 10 · 4 min readThe 2.5 GB Wall: Why My tshark Wrapper Died, and How Streaming Fixed ItThe tool that worked I built a CLI tool that wrapped tshark for PCAP analysis. Grab the file, send shell commands, let tshark analyze it, capture the output, shape it, return it. Quite simple, right. robinhayer.hashnode.dev
