Latest Articles - Page 4

Open a Log4Shell training capture in Wireshark, find the JNDI lookup, and follow the LDAP callback and class download.

Read a Windows Kerberos capture in Wireshark and tell a normal pre-authentication exchange from a failed TGT or service-ticket request.

Install and configure Windows NPS as a RADIUS server, register it in Active Directory, and confirm Access-Accept with a RADIUS client, shared secret, and network policy.

Point FreeRADIUS at OpenLDAP, test PAP with radtest, and return a different RADIUS reply for each LDAP group.

A forwarding loop repeats the same broadcast frame until the VLAN fills up, and Wireshark shows that repetition before you hunt for the switch port.

Configure a FreeRADIUS user, then test PAP and CHAP with radtest and see why CHAP fails without a cleartext password.

Use Windows NPS as the RADIUS server for Cisco administrative AAA, return shell:priv-lvl from a Network Policy, and read Access-Accept, Access-Reject, and accounting in Wireshark.

Decrypt HTTPS and LDAPS in Wireshark with SSLKEYLOGFILE, see which TLS libraries actually write the key log, and fix an empty or mismatched session-secret file.

Read the RDP negotiation in Wireshark, see why port 3389 becomes TLS, and learn what CredSSP decryption can and cannot show.

Compare TLS and mTLS in Wireshark, find CertificateRequest and the client certificate, and learn why TLS 1.3 hides them until the handshake is decrypted.

Find an HTTP response in Wireshark, filter 4xx and 5xx status codes, jump to the matching request, spot requests with no reply, read http.time, and see how a large body is reassembled from TCP segments.

Learn how Wireshark configuration profiles save custom columns, filters and coloring rules, then build a DNS profile, auto-switch to it, and export it for another workstation.

Read TCP sequence and acknowledgment numbers in Wireshark with Seq, Next Seq, Ack, and Len columns, learn the two formulas that explain most forum confusion, and apply the math to your own TCP capture.

Find a rogue DHCP server in Wireshark by filtering DHCPOFFER packets, comparing Server Identifier and gateway options against your authorized list, then tracing the rogue MAC through the switch CAM table.

Find duplicate IPv4 addresses in Wireshark with arp.duplicate-address-detected or Expert Information, then filter the conflicted IP to compare the MAC addresses claiming it.

Use Wireshark display filters to find LDAP bind failures, inspect the bind DN and search filter, read resultCode errors, and spot slow directory responses on ports 389 and 636.

Current Wireshark cannot arbitrarily edit decoded fields in the GUI. Use editcap for capture-file changes, Scapy or tcprewrite for header rewrites, and verify every edit back in Wireshark.

A TCP reset looks like it came from the server—but did it? Use Wireshark TTL and RST filters to compare normal packets and identify resets likely injected by a firewall or other middlebox.

See when bandwidth spikes in Wireshark, then identify the host, TCP conversation, and protocol responsible using I/O Graphs, Endpoints, and Conversations.

Learn how to check whether SSH is using protocol 1 or 2, what OpenSSH version strings such as OpenSSH_7.4p1 mean, and how to read SSH-2.0 banners and verbose SSH output.

ServiceNow business rules interview questions for {year}: before, after, async, display, and query rules, Order field, current and previous, recursion, ACL vs query BR, debugging, and scenarios—with sample answers.

Configure Keycloak SAML Single Logout, inspect LogoutRequest and LogoutResponse messages, verify sessions on both realms, and diagnose a successful response that never reaches the service provider.

See why an Envoy Gateway WebSocket drops after HTTP 101, how the default stream idle timeout works, and how to tell a proxy close from a backend close.

Sign Keycloak SAML responses and assertions, require signed AuthnRequests, encrypt assertions to the service provider certificate, and check the XML with the peer public key.

See why Envoy Gateway returns HTTP 504 upstream request timeout at about 15 seconds, and how HTTPRoute timeouts.request and backendRequest change that deadline.

See why Envoy Gateway returns HTTP 408 when an upload arrives too slowly, and why that clock is not a body-size limit or proxy-read-timeout.

See why ingress-nginx proxy-read-timeout is an inactivity gap, and why copying that number onto HTTPRoute timeouts.request is a different deadline.

Tell an Envoy Gateway 504 from a slow-upload 408 and from an ingress-nginx proxy-read-timeout, and open the page that matches the failure.

Replace ingress-nginx proxy-body-size with Envoy Gateway requestBuffer.limit, and see why that policy buffers the whole request before it returns HTTP 413.

Bootstrap a local CA with cert-manager, sign an Envoy Gateway certificate from that CA, and verify HTTPS with curl --cacert when the hostname has no public DNS.