NetworkMiner

Recently I got a chance to try NetworkMiner. It’s a network forensics program. It can be used as a passive network sniffer to detect :

• operating systems
• sessions
• hostnames
• open ports
• etc

It can also be used to analyze PCAP files.

ModSecurity Core Rule Set 2.0 Released

Breach Security has released ModSecurity Core Rule Set (CRS) 2.0.

There are several changes compare to the previous one (version 1.6.1) :

• It is now an OWASP Project
• It has its own mailing list

Refresh Your DNS Cache

Several days ago, when I pinged google.com, I saw the following :

$ ping pop.gmail.com
PING pop.gmail.com (208.67.219.130) 56(84) bytes of data.
64 bytes from hit-adult.opendns.com (208.67.219.130): icmp_seq=1 ttl=51 time=832 ms
64 bytes from hit-adult.opendns.com (208.67.219.130): icmp_seq=2 ttl=51 time=936 ms

That couldn’t be right. So I investigated what cause this problem. Finally I found out that my DNS cache was messy, so I cleared it by issuing the following command :

# /etc/init.d/nscd restart
Shutting down Name Service Cache Daemon                               done
Starting Name Service Cache Daemon                                    done

I did a ping again :

$ ping pop.gmail.com
PING gmail-pop.l.google.com (209.85.147.109) 56(84) bytes of data.
64 bytes from wa-in-f109.google.com (209.85.147.109): icmp_seq=1 ttl=236 time=1354 ms
64 bytes from wa-in-f109.google.com (209.85.147.109): icmp_seq=2 ttl=236 time=980 ms

Now it was right.