Network
guest@6admin.io:~$ ls ~/tags/network
An IDS probe cannot see TLS
Suricata labs built on plain HTTP are excellent for teaching, but they hide a major blind spot once in production: encryption. A promiscuous probe sees TLS and can inspect nothing. Where to place inspection instead.
Network segmentation
Network segmentation and isolation: VLANs, zones, routing and the boundaries you do not cross without a reason.
Portknocking and SSH tunneling: the magic tricks before WireGuard
WireGuard ships in 2016 and makes two beloved 2008 setups outdated: portknocking (with automatic combination generation, mandatory NTP and an encfs USB key) and SSH tunneling. The era's tone, the in-production demo until 2018 at a hosting provider and why a VPN that says nothing wins.
SSH: ProxyJump and modern multi-hop
ProxyJump, the -J option that arrived with OpenSSH 7.3, replaces the old ProxyCommand + nc for crossing one or more jump hosts. Shorter on the command line, cleaner in config and with no key left lying on the bastion.
Haproxy: the reverse proxy that took over from Pound
After Pound (the 2008 article), the floor above: haproxy 1.3, TCP and HTTP modes, ACLs, backends and health checks, the stats page. What a reverse proxy must know how to do before being credible.
Bash: Geolocation, the trilogy
Bash geolocation, from netcat to /dev/tcp. V1 was lost with the disk, v2 is the revenge of netcat, v3 is the revenge of bash.
NTP: time synchronization over the network
NTP, the protocol that synchronizes clocks and why it matters when your scripts depend on the time.
Bash: IP address obfuscation
Representing an IP address in decimal, hexadecimal, octal and what it changes for logs.
OpenDNS: the free DNS
OpenDNS, the public resolvers that preceded Google DNS and Cloudflare and the question of the trusted third party.
ArpON: watching your ARP cache
ArpON, the daemon that blocks ARP cache poisoning attempts where Arpwatch only reports them.
Yersinia: how to make your network administrator sick
Yersinia, the layer 2 protocol attack framework and why your switch does not protect you the way you think.
SNMP: a not-so-simple protocol
SNMP, the protocol that monitors the network, its OIDs, its public/private communities and the MIBs nobody reads.
tcpdump: frame analysis and BPF filters
Tcpdump to read the network byte by byte and BPF filters that turn a packet flood into a single question.
Nemesis: detecting a network sniffer
Detecting promiscuous-mode cards on your network, the defensive side of the packet forge.
Nemesis: network packet forge
Nemesis, the tool that forges any TCP/IP packet from the command line, without writing C.
Raw Sockets: forging and sniffing packets in C
The sockets memo, continued: AF_PACKET, SOCK_RAW, the iphdr and tcphdr structs, manual checksums, promiscuous-mode sniffing and SYN packet forging. What tcpdump and Nemesis do, written by hand, as root, with ethics and humor.
Sockets: speaking TCP in C, no framework, no magic
An era memo in C: socket(), bind(), listen(), accept(), connect(), the sockaddr_in structs, byte order and a fork() per connection. How to write a TCP server and client in sixty lines, on a Debian Etch, with only the man pages for friends.
SSLH: ssh and https on the same port
A 2007 memo: sslh multiplexes ssh and https on port 443, the only port of paranoid firewalls. How it works, what it allowed and why (edit 2026) nobody would put it in production today.
SSH: tunneling
SSH tunneling, making any protocol cross the encrypted channel.
iodine: IP-over-DNS, or the internet where only DNS passes
Iodine 0.3.1, the IPv4-over-DNS tunnel and the captive portal that only filters HTTP but resolves any name. The portal gives you DNS, therefore it gives you the internet.
dig: the Domain Information Groper, or the art of asking a name server
Dig versus nslookup, the anatomy of a DNS response read flag by flag, compared SOA records to check zone propagation and AXFR as an audit tool. The tool that would test a tunnel the following month.