Windows Forensics: Prefetch 101

While attending the annual Texas Cyber Summit recently, I watched a talk by Marcus Guevara of Recon Infosec titled “The Best Free Resources to Get Started in Incident Response.”  One of the things he mentioned in that talk is Windows Prefetch – something already built into Windows by default. I had never heard of Prefetch …

Continue reading Windows Forensics: Prefetch 101

Cisco ISE: Adding Network Devices

In ISE, switches are referred to as a Network Access Device (NAD).  Other NAD devices include wireless LAN controllers and VPN concentrators.  NADs are responsible for enforcing ISE policies on devices connecting to the network with MAB authentication via RADIUS, as well as authorization of remote device administration over SSH via TACACS+. Before a switch …

Continue reading Cisco ISE: Adding Network Devices

SolarWinds Orion NPM: Configuring Cisco Hardware Health Pollers

While troubleshooting an issue with a 4506 switch recently, I discovered an interesting discrepancy: Orion was reporting a critical hardware issue on the switch, but the switch itself didn’t seem to have any idea that anything was wrong. The exact error I was seeing was that a supply voltage sensor for a fiber switchport interface …

Continue reading SolarWinds Orion NPM: Configuring Cisco Hardware Health Pollers

Cisco ISE 2.x: MAC Authentication Bypass (MAB)

MAC Authentication Bypass (MAB) is a method of network access authorization used for endpoints that cannot or are not configured to use 802.1x authentication.  MAB uses the hardware address (MAC address) of the device connecting to the network to authenticate onto the network. This hardware-based authentication happens when a device connects to a Network Access …

Continue reading Cisco ISE 2.x: MAC Authentication Bypass (MAB)

Wireshark Fundamentals: Setup and Configuration

Wireshark is an open-source tool which is used to perform packet capture and analysis for wired or wireless network traffic.  It can be intimidating to look at the first time you open a packet capture file (or pcap).  Hopefully this introduction will help smooth the sharp edges on learning this tool. I was first introduced …

Continue reading Wireshark Fundamentals: Setup and Configuration