JJoseph O'Shaughnessy4d ago · 12 min readDiagnosing a Failed TCP Handshake in WiresharkWhen someone says "the application is down", the quickest way to settle whether it's the network is to look at the TCP handshake. If the three-way handshake never completes, the application never getsjosephoshaughnessy.hashnode.dev
JJoseph O'Shaughnessy4d ago · 12 min readFinding an MTU Black Hole with ping, tcpdump and WiresharkYou can SSH to the server. The login page loads. Ping works. But the moment someone downloads a large file or opens a big report, it just sits there, and eventually times out. Everyone swears the netwjosephoshaughnessy.hashnode.dev
Mmhk cyberOct 3 · 6 min readMy First Wireshark PCAP: Kongtuke Rebuke! So I decided to learn Wireshark. I watched like a 20minute video on YouTube, understood the basics, how to apply filters, conversations, endpoints, some of the protocols, etc. Nothing too crazy. Then mhk-cyber.hashnode.dev
JJebitokSep 22 · 10 min readPacked Light: Wireshark x Cryptography - XOR & Base64 - Forensics (TryHackMe)Link to the challenge on TryHackMe: Packed Light 🛎️ Concierge Briefing Tiny packets. Odd hours. Suspiciously regular. Someone's smuggling out the data equivalent of a hotel towel every night, foldedsharonjebitok.com
RRobin HayerSep 21 · 5 min readThe tool said it wrote 48 packets. Only 44 were thereRecap I have been developing a tool wrapped around tshark. The first blog post was about hitting a wall on a 2.5 GB file. Later, I talked about parallelizing the PCAP processing in my second blog postrobinhayer.hashnode.dev
PPreetimantSep 15 · 14 min readUnderstanding Modbus/TCP Through Packet Analysis — HTB Watch TowerWhile working through Hack The Box's ICS/SCADA track, I completed Watch Tower, an introductory packet-analysis lab built around Modbus/TCP traffic. The challenge itself was fairly short: a PCAP capturpreetimant.hashnode.dev
RRobin HayerAug 26 · 5 min readConcurrency Without a Parallel Parser: Splitting PCAPs by SessionWhere the last post left off In my first post about the 2.5 GB wall, streaming fixed memory. It didn't fix throughput. The pipeline was still one file, one tshark process, one core. Piping stdout to srobinhayer.hashnode.dev
YYogeshwar PeelaAug 10 · 35 min readTryHackMe : Overflow The Jackpot writeup# Challenge Category Flag 1 B1t Recovery Crypto THM{[REDACTED]} 2 Lost Fortune Included Web THM{REDACTED} 3 Casino Heist Forensics THM{REDACTED} 4 Fresh Powder - Bonus Challenge Detection Eng1exploitnotes.hashnode.dev
RRobin HayerAug 10 · 4 min readThe 2.5 GB Wall: Why My tshark Wrapper Died, and How Streaming Fixed ItThe tool that worked I built a CLI tool that wrapped tshark for PCAP analysis. Grab the file, send shell commands, let tshark analyze it, capture the output, shape it, return it. Quite simple, right. robinhayer.hashnode.dev
YYogeshwar PeelaAug 10 · 15 min readTryHackMe : WhyHackMe writeupSummary WhyHackMe is an medium Linux box that chains a handful of low-friction bugs into root. Anonymous FTP leaks a hint pointing at a pass.txt file that's only reachable from localhost. The blog app1exploitnotes.hashnode.dev
