21 Musings From Incident Response
These are my personal anecdotal conclusions and I totally appreciate it may not line up with anyone else’s. This is US centric, as that is my experience, a...
These are my personal anecdotal conclusions and I totally appreciate it may not line up with anyone else’s. This is US centric, as that is my experience, a...
Situations where it’s useful to analyze traffic: Don’t have access to the logs Want to look at traffic somewhere upstream like an LB Something is mak...
A resource maintained by the fabulous Dan Luu
Getting help and soliciting feedback on the Internet essential reading:
If you stayed late at the DevOpsKC meetup last night you have may have caught me giving this talk about getting a monitoring system going using python from e...
I walked through these slides demonstrating the simple tool sup.py I wrote at the devops kc meetup. Sup can be used in place of ping/tcping/httping on some o...
Throwing some load at your setup and seeing how it reacts.
Grabbing tcpdump output during a crisis can be hard to remember. Ideally, snort is running as as service inline or at least continually. Sometimes things hap...
I have a bash script that is being called multiple times instead of once. I need to track down where it is being called from.
Launching a SYN flood. Everyone know DDOS attacks happen and of these SYN floods may be the simplest to organize for attackers. As a defender you don’t want...
SRE: “When does it need to be done?” PM: “Next week at the latest.” SRE: “OK, we spend from now to next week working on a time machine. If we ha...
So name.com was hacked and deviantart.com was one of the credentials dumped from their DB. How do I know? Name.com Tells Customers To Change Password Due To...
This configuration is Cisco based but JunOS isn’t too far of a stretch in my experience. First off: you need your ASN. You need your address block. Your add...
I remember hearing a lot of conflicting information about BGP when I first started doing network admin stuff. A lot of time BGP is part of an HA strategy and...
KVM is great but I’m making a note so I remember because this command gives me pause every time. When a new VM has no OS or doesn’t make it past the bootloa...
If you have tiered levels of administrators, or you want to create an account for automation purposes best practice is to define a custom security level in I...
When dealing with totally unstructured data sometimes it is necessary to go full regex.
JSON REST API’s are increasingly common and useful. A basic client example for using something like nagios api import sys import os import urllib import js...
Granular control over Debian MOTDMOTD should be used for more than welcome messages
Depending on the type of counter you want to track you can use one of the two SNMP following OIDs ‘64’ bit counter => oid => ‘.1.3.6.1.2.1.31.1.1.1’ ...
Getting JSON from a flat file in a shell script
My second day at a job in 2007 I showed up early. I came in the unlocked front doors and I set off an insane alarm.
Show me my non-default databases
I have a host with MAC 00:30:48:60:f3:ca. This host is configured to look for a PXE server, but was not matching the correct profile.
If you have crashes you can enable core dumps via Puppet
When was this host last updated via puppet?
One of the things I do often is download projects from github. Pypi (py-pee-eye) is nice and so is pip, but I like to have one reference for packages on a ho...
Some commands do not natively support a proxy (RE: telnet). Other times it is just easier to do a one-off instance rather than mess with environment setting...