Turkey Technology

It's here again... the dreaded 'Turkey Day'. Time to be humiliated in the kitchen once again...

Three times now I have been thwarted by technology in my attempts to cook the perfect turkey.

Year 1: Bought frozen turkey; put in refrigerator to thaw. Tough getting the thermometer into the dang bird (nearly broke the hammer I used to get it in). After 3 hours, thermometer never moved off '0' - figured the thing was broken. After 4 hours and a nicely browned skin in view, pulled turkey out and dressed it up for serving only to find that the bird must have still been frozen and there were bags o' turkey guts/neck still thawing inside the bird - whoops. Chinese restaurant open today. I am thankful for Mu Shu Pork!

Year 2: Thermometer got a bad rap last year. Thawed turkey completely; pulled out all bags o' bunk; into the oven it went. After 4 hours and a nicely browned bird, the thermometer wasn't up to the desired 165 degrees. Gave it another 2 hours and it still didn't get to 165... smell indicated something wasn't right. Removed charred and whithered bird and threw away thermometer. Papa John's is open today. I am thankful for pizza!

Year 3: Martha Stewart's 'high-heat' turkey would only take 2 hours to cook an 18 pounder - no thermometer needed - guaranteed by Martha. Bought the Martha roasting pan, cranked up oven to 475 degrees and threw the damn bird in. Set timer for 2 hours and relaxed with a glass of wine. Determined not to fret over bird. After two hours, opened oven to find the turkey took the heat quite well, but Martha's roasting pan didn't - flakey pieces of some coating material wafted up in the air and was stuck to the outside of the turkey, spotting it with silver 'snowflakes' of faux aluminum or some other toxic substance. Pulled out batch of spaghetti sauce I'd made that morning just in case. MMMM.... a home cooked meal on Thanksgiving! I'm thankful for foresight and decent chardonnay from a local winery.

This Year: After 3 years of humbling experienes and technology failures, friends have stepped up to invite my family to 'stop by' on Thanksgiving. Kids a bit to excited over the idea. Hmmm... Planning on going house to house bringing store-made pies and wine. My family and I will mooch our way through Thanksgiving and hope to spare the life of one turkey this year. No technology to count on other than my car. I expect my friends will share my 'turkey travails' with all the guests - I hear it's a good dinner story... I am thankful for my friends.

Next Year: Premade turkey with lasagna as a back-up (in case the bird doesn't fit in the microwave for reheating - the oven is retired and now stores kitchen items I'll never use again).

Happy Thanksgiving to all who celebrate.

Laura

Summit08 Wraps!

Puff, puff... It's a heck of a lot of work putting on a conference - hats off to the folks who do it year in and year out and actually smile through the process (they must have some strong meds). You are a sick lot, you know! Anyone care to guess how many pieces of bacon, sodas and beers were downed during the two-day Troubleshooting and Security Summit08 conference (November 4-5)? Me neither.

One of the highlights of the conference was having Gerald Combs (creator of Wireshark) join us to talk about capturing traffic in a virtual environment and Tom Quilty (BD Investigations) talking about the steps to take before and after a network breach occurs. Who ya gonna call?

It was great sitting around a table at the vendor party with those two as well as Ron Nutter from Network World as we swapped geeky war stories and shared some of the inside scoop on cybercrime events and Wireshark development (which are mutually exclusive topics, by the way). He he...

For those of you who didn't join us, you missed a great time. We played with VoIP reassembly, some ugly WLAN communications, loads of ugly file transfers caused by packet loss/high latency, a DHCP server gone awry, nasty SNMP traffic (that we configured to see using the MIB printer configuration), problems with autonegotiation, SMB2 protocol negotiation during a Vista client/Server 2008 connection, lost packets, totally pathetic websites, evidence of a "DNS walking" application, a redirector infection, SNMP scanning host and traffic hidden through port swapping.

Two nights before the conference I added a set of trace files taken at a client and a server - I really wanted to show how to alter the timestamps because one analyzer was off on the timesync and then merge the two traces together, colorizing the two sets to differentiate them. I love this stuff!

Now my days are spent buiding the Summit 08 Wrap-Up site - if you attended Summit 08 you will receive your login credentials by the end of the week. I've put together four videos covering the MS08-067 vulnerability, the trace file merging process, building and sending custom packets and the Summit 08 Wrap-Up Checklist. In addition, I have a discount code for NetScanTools Pro and Pilot/Pilot+AirPcap EX3 bundle also going up on your Wrap-Up site (you already should have the code for 50% off the Wireshark University self-paced courses - good through December 31st).

So... would we ever do the conference again? Absolutely! We've already started planning based on the feedback we received. Register for notification at http://www.chappellsummit.com/ and I'll send you an email when Summit 09 registration opens and details on the Early Bird Special pricing. Alumnae will get special discounted pricing on Summit 09.

Now... just a couple more days until I head off to Portugal for the Vantagem conference. After that, it's the ATT Live conferences in Salt Lake City and then... well... then it's 2009 and time to start development on Summit 09!

Laura

[off to the Wrath of the Lich King launch party... 2 hours and counting...]

Pimping Podcasts and Packets

Well... with a title like that you just have to read this, don't ya?

Ok... there are really two subjects here - one is pimping podcasts and the other is packets, but they came together this evening with a new podcast series I am developing and a quick analysis of some podcasting traffic.

Pimping podcasts? This title came to mind as I searched for some lead-in/closing music for the upcoming podcast series. After searching for royalty-free music for a bit, I found a little ditty that turned my head (including my ears). The music was described as "70's, pimp-stylin, funkin', porn music. If prostitution is a victimless crime, then where's my wallet?"

I HAD to listen to this music!

Sure enough - this was some seriously funky music - it dripped of sexual innuendo with loads of wawawa slipping through dadum dadum with a funk beat - this could have been background music for Shaft! I could honestly imagine myself following that attitude-adjusting swank with a serious conversation about the If-Modified-Since HTTP header field! What a mood setter!

Note: We'll cover the importance of that header field in the upcoming Summit 08 (http://www.chappellsummit.com/) when analyzing web browsing traffic.

So what do packets have to do with this? Well... since I was on the topic of podcasting, I thought I'd check out the traffic rate of the recent podcast I did with Ron Nutter's Help Desk Toolchest over at Network World (http://www.networkworld.com/podcasts/nutter/) - I found that the podcast MP3 file was 31,640,580 bytes and downloaded in just over 30 seconds at an average rate of 8.77 Mbit/s. This was waaaaay bigger than the Internet radio trace I'd taken a while back when studying streaming methods and bandwidth usage. Ron's podcast runs for 65 minutes and 55 seconds. When there I injected traffic into the network to cause packet loss and higher latency, I didn't notice it at all.

Tomorrow I should finish my analysis of Spore's network traffic and have the signatures to spot and eradicate that little primordial slime off the network (oh, sure... play it at home all you want!).

Laura
Don't forget - register for the Summit by September 30th for the Early Bird Special!
http://www.chappellsummit.com/

Where the *(@#$# Have I Been?

It's been ages since my last post - so where on Earth have I been (assuming I've been on Earth, of course). Good question...

I've been halfway around the world in Canberra, Australia (snoooooooze) and assorted places in the US. Mostly, however, I have been buried in the deep, dark and exotic... lab! Playing around with the VoIP analysis functions in Wireshark, cool enhancements in NetScanTools Pro and wireless views in Pilot. I'm also enjoying playing with systems that have been left naked and exposed on the Internet (eek!) - analyzing the methods used to compromise those systems.

I've also been writing a series of articles on topics ranging from "Optimize Your Network Regardless of IT Budget Cuts" (www.chappellsummit.com) to "Getting More Pool Time (aka Graphing Wireless Network Behavior with Pilot™)" (searchnetworking.techtarget.com) and "Enhancing Windows® XP Performance with RFC 1323" (also searchnetworking.techtarget.com) and a few podcasts with my friend Ron Nutter were we discussed DNS security faults, strange traffic on the network (check out the live analysis results of going to www.usatoday.com - yucko!), and Microsoft's TCP enhancements in Vista/Server 2008 (all three to air at www.networkworld.com/podcasts/nutter/).

Most excitingly, however, I've been working on the Student Manuals for the Summit (Network Analysis and Network Forensics Training) that takes place November 4-5 (www.chappellsummit.com) - I extended the Early Bird registration price until September 30th because of the hardships caused by Ike and the roller coaster ride we call the Stock Market.

Over the next two weeks I'll be releasing some of the lab information for the Summit - giving you a taste of the hands-on labs that we'll tackle together. Oh, yeah... we'll definitely do some VoIP playback and work in the wireless world! Join us for accelerated analysis/forensics training at the Summit.

Better go - it's 5:30pm and I have a few more hours-worth of trace files I want to review this evening! Yippie!

Laura

Summit 08 Registration Brings Nausea...

At typical conferences, I only have a 1 hour 15 minute time slot to present information - hardly enough to do more than whet your appetite for packet-level life. It is very frustrating when I really want to ensure attendees grasp concepts and walk out with solid skills for immediate gratification. So... I cancelled most of my remaining conferences this year to focus on development of my Troubleshooting and Security Summit on November 4-5th in Las Colinas, Texas (near DFW). Visit www.chappellsummit.com or www.wiresharkU.com.

Geez... it takes a ton of work to put on a Summit/Conference! Reviewing the contract with the hotel nearly made me gag! We did select a fantastic hotel and we hope to take over the entire ballroom/meeting room area - giving us plenty of room to spread out with our laptops and great visibility for all attendees. Hey - if you're going to head out and spend time geeking out with us, you might as well be someplace nice (sorry, Detroit Days Inn... I just couldn't do it!).

I am working on the student kits and the new sets of trace files. I am most excited to work together on the new Microsoft TCP/IP stack stuff, optimization of XP communications and then the compromised host evidence area. In addition, we'll get to work with new trace files of unusual/suspicious traffic to locate their signatures and figure out how to block this crap from the network. Users get more bold every day with the dirty applications they try to run on network!

There was a major change made from the time we polled the mailing list to the current time - I want to give all attendees a copy of the WSU03: Troubleshooting Network Performance self-paced DVD course instead of the WSU02: Analyzing TCP/IP Communications. The WSU02 stuff is the perfect prerequisite to ensure you get the most out of the conference.

New trace files - new toys (uh, er... I mean tools) - hands-on labs! It's gonna be a blast! Make sure you register before September 1st to get the Early Bird Special. Ideally, I'd like to have enough attendees to ensure we take over the hotel. Oh, yeah - and hotel room discount rates are only available until October 20th.

Get the full outline and details at www.chappellsummit.com and let me know your thoughts!

Laura

No One Wipes Blood Off Their Own Face in Movies!

Well... it's another late night for me... insomnia rules my world at times and I've spent the day working with the new video training interface and the lab exercises for the Pilot beta course (which is debuting on July 18th - check out the calendar page for details).

I am finally settling in to watch a movie (oh, and blogging...) - "The Interpreter" is on... a smarmy show with beautiful-but-quesionable-actress Nicole Kidman and amazingly-talented-but-no-one-I'd-let-stay-in-my-house Sean Penn. The scene that just played had Sean Penn grabbing a paper towel, wetting it down and wiping the blood off Nicole Kidman's face. Now why is it that in movies no one can wipe the blood off their own face or put a simple bandage on their cuts? Geez... if we acted the same way I'm sure we'd all be walking around with oozing wounds and blood-stained faces, hands and feet. Ok... Hollywood is not reality (I want you all to remember that when the "Mother of Invention" movie comes out - if it ever does).

On that note... I've received numerous queries about the film. Last week I spoke with the main writer - the script is on it's 10th rewrite. He asked me some questions (I'm Technical Consultant on the film) about Navy Seals and intercepting radio-control signals. Now what the hell does that have to do with my life? Oh, wait... I'm not supposed to talk about those jobs... Seriously folks... when the film does come out it will have little relationship to my real life (except for that diaper-packed suitcase scene - believe it or not - that is true).

So back to the Pilot labs now - it's just past 12:15 am and I have another 3 hours or so of energy and focus left. I'm excited about this new course - as excited as I am with Pilot. If you don't know about Pilot, check out CACE Technologies' website. I just saved myself about 10 hours creating a report for a customer by using Pilot.

Oh... gotta go - final scenes coming up - helicopters and all... hey, wait a minute! I didn't see any helicopters in my film script!!! Time to make some calls... someone in Hollywood's gonna need some Bandaids!

Laura

Bag Lady of TechEd...

Those quizzical looks said "don't you have a hotel room?" After dragging around a suitcase of toys (uh, er... I mean 'tools') during TechEd, I really appreciate the guy/gal who invented roller bags. The lunch session today - while only 45 minutes long - finally offered me a chance to unload the bag and share some of my favorite tools. From the hot graping tool, Pilot, to NetScanTools (my key reconnaissance/traceback tool) and the infamous SumoBots, Ironkey, the self-destructing USB stick and the Phantom Keystroker that plagued some of the CommNet stations at various points during the network - the 45-minute sessions was a 'spewfest' of fun.


If you'd like to see the list of some of my favorite tools, check out www.wiresharkU.com/tools - if there are tools I should add, send an email to tools@wiresharkU.com.

This week I also created a page with some information and product discount codes over at www.wiresharkU.com/teched. Even if you didn't go to the show, grab the discount codes for AirPcap, NetScanTools, Pilot and the Wireshark University Courses - watch the expiration dates - don't miss your chance to save some money on these hot items.

So what about that Thursday panel? Seated between Steve Riley and Mark Russinovich - the same seating arrangement we had in Barcelona, I knew it would be a hoot. Mark Minasi and Marcus Murray rounded out the geekfest at the front of the room. Without any introductions or scripting, it was a great opportunity to just chat about the issues - unbeknownst to the audience, we rarely all get together in the same room and the same time. When we do... you have five Type A personalities butting heads and trying to one-up each other's stories... and what stories they are!

Now... it's time to relax in the hotel room - I'm totally wiped out from four breakout sessions, a panel, a lunch session, four 'fishbowl' recordings and one TechNet Edge recording (oh, yeah... and some late nights out at the hotel pool and an evening of non-stop walking around Universal Studios).

Off to the HP TechForum conference in Las Vegas - with a pre-conference training session Monday and several sessions Tuesday, it will be a busy week. After that, however, I am thrilled to enjoy the summer with minimal travel. That will give me lots of time to play with new toys and tracefiles. Wheee!

Laura