The Highlighted Route (Paul W. Smith)

 

It is in our nature as humans to plan. Some of us do it formally, writing down step by step instructions with a well-defined goal in mind. Others plan at a smaller scale, often thinking about step 2 after step 1 is underway. If you are out doing errands, advanced planning can save time with a more efficient route. If you are doing a project, planning can help avoid painting yourself into a corner (literally). When it comes to travel, planning might include packing things you will need or putting a hold on the mail, but it most definitely will involve some sort of pre-determined route. Airline pilots do this sort of route planning routinely to conserve fuel, avoid bad weather, and arrive at their destination on time. They submit a formal flight plan to document their intentions.

Automating Packet Analysis with Sharkd and Python

 Have you ever had one of those days when your packet analysis seems doomed?  We start looking and quickly realise that there are duplicates of all the packets in one direction.  So we process the file with your favourite de-dup tool and try again.  Next we find some packets were dropped during capture.   Hopefully, we have enough.  Hang on, where's the traffic to the server?  Things are going from bad to worse and we are already 2 hours in.

How TCP Works - The Timestamp Option (by Chris Greer)

 

In the TCP handshake, you may see an option called timestamps, shortly followed by scary-looking “TSval” and "TSecr" numbers. What are those values and how can you interpret them? Let’s dig.

What is a TCP Timestamp?

Getting Started Is The Tough Part

Regardless if you are troubleshooting, baselining, profiling, installing or designing, getting accurate data is critical.

We’ve all heard that old saying “garbage in, garbage out” but what about “no data, no chance”?

When I present or teach, I try to instill some basic concepts and methodologies to help attendees regardless of their role or what tools they may have.

The first suggestion is pretty simple "get out of your chair”. When possible, visit the site, or client to get a proper perspective of the issue, see the equipment and site and gather first-hand information. In this day of video calling, and the ability to easily record video or take photos from your phone, you can ask the client to ‘show you the issue’ or have them them 'walk  you around the site". The other day I found a hidden access point with the help of a Zoom call.

How to Decrypt TLS Traffic in Wireshark Using Session Keys (Chris Greer)

Chris Greer’s walkthrough on decrypting HTTPS traffic in Wireshark is one of those rare tutorials that makes a pretty intimidating topic feel surprisingly doable. He breaks down how TLS 1.3 session keys work, why you normally can’t peek inside encrypted packets, and how a simple environment variable on Windows lets you capture those keys right from your browser. It’s approachable, but still nerdy enough to scratch that packet‑analysis itch.

The core trick is setting the SSLKEYLOGFILE environment variable so Chrome writes out the session keys as it negotiates TLS. Once you’ve got that log file, Wireshark can use it to decrypt the encrypted streams in real time. Chris walks through the exact steps—Control Panel, Advanced System Settings, Environment Variables—and shows how to plug the keylog into Wireshark’s TLS preferences. If you’ve ever wanted to see what’s actually happening inside HTTPS without guessing, this is the cleanest path in.