A Series of TCP Diagnostic articles!

 

Chris Greer, a noted Network Analyst , wrote Five super TCP diagnostic articles for Accedian!

• TCP Series #1: How to diagnose TCP Connection setup issues?

• TCP Series #2: How to close TCP sessions and diagnose disconnections?

• TCP Series #3: How to analyze TCP retransmission & duplicate ACKs?

• Number 4 - Below - TCP Receive Window

• TCP Series #5: How to analyze TCP window problems?

Click on the TCP Series above and read each one of these dives onto the TCP World!

Potential Security Threats North American Businesses Could See and What to Do About It

 Current geopolitical events have most people and businesses concerned, as evidenced by political protests, stock market performances, and questions raised around new government restrictions for businesses. While the simple fact is that most individuals can’t do much about the conflict, North American businesses can, and should, immediately put into action self-protection mechanisms. Even though the physical fighting may be located in Eastern Europe, cyber warfare is a global event. Businesses need to take heed now and immediately do what they can to protect themselves.

Nothing Worse Than a Stale Tool

There is nothing more frustrating than picking up a tool only to find that you cant use it, or its not working as expected.

In this day and age, network tools have evolved to basic computers, running an operating system, memory, processor and software.

AirCheck™ SSID AP Troubleshooting

 

it is quite common to have several physical access points support the same SSID. Every vendor has its own way of handling handoffs and in most cases, it works pretty well. But what do you do when you suspect one access point is causing an issue?

I don’t care which operating system you are using; it is very difficult to select one physical access point to connect to. I should know, I tried for hours with Android and several Windows applications with no luck.

Nirsoft's WhoisConnected Review

 

Thought I would try out this nirsoft.net “who is connected utility” from www.nirsoft.net. I am a big fan of nirsoft because their utilities are specific, small, portable, no ads and support is responsive.

From the readme file

“WhoIsConnectedSniffer (https://www.nirsoft.net/utils/who_is_connected_sniffer.html) is a network discovery tool that listens to network packets on your network adapter using a capture driver (WinpCap or MS network monitor) and accumulates a list of computer and devices currently connected to your network. WhoIsConnectedSniffer uses various protocols to detect the computers connected to your network, including ARP, UDP, DHCP, mDNS, and BROWSER.

For every detected computer or device, the following information is displayed: (Some of the fields might be empty if the information cannot be found inside the packets) IP Address, MAC Address, name of the device/computer, description, Operating System, Network Adapter Company, IPv6 Address.

After collecting the connected computers/devices information, you can easily export the list to tab-delimited/comma-delimited/xml/html file.”

I wanted to see if the software truly listens or if it queries devices to determine more information. So I configured Wireshark with an IP address of a random device – a wireless router acting as an access point and was surprised to see that it send out a Browser Announcement and SMB Domain Enumeration. Why would it do this when I have no storage installed and no protocols configured?