Command line: Using tcpdump to find scanning activity

Command line: Using tcpdump to find scanning activity

Great Stuff from packetbomb.com

Windows DNS Server: Security Settings

Do a DNS test at:
DNS Stuff


You will get warnings of various kinds.  A couple of important fixes are:

Disable Version Query

dnscmd /config /EnableVersionQuery  0




Disable Recursion

dnscmd  /Config /NoRecursion 1

Active Directory Firewall Ports – Let’s Try To Make This Simple | Ace Fekay

Active Directory Firewall Ports – Let’s Try To Make This Simple | Ace Fekay: Active Directory Firewall Ports

Good summary.

List all SPNs in Active Directory

From TechNet

cls
$search = New-Object  DirectoryServices.DirectorySearcher([ADSI]“”)
$search.filter = “(servicePrincipalName=*)”
$results = $search.Findall()

 

#list results
foreach($result in $results)
{
        $userEntry  = $result.GetDirectoryEntry()
        Write-host "Object Name = " $userEntry.name -backgroundcolor "yellow" -foregroundcolor "black"
        Write-host "DN      =      "  $userEntry.distinguishedName
        Write-host "Object Cat. = "  $userEntry.objectCategory
        Write-host "servicePrincipalNames"
        $i=1
        foreach($SPN in $userEntry.servicePrincipalName)
        {
            Write-host  "SPN(" $i ")   =      " $SPN       $i+=1
        }
        Write-host ""

} 

Packet Capture From Cisco Router

7K

ethanalyzer local interface inband limit-captured-frames 20000 autostop duration 120 write bootflash:capture.pcap

IOS-XE Router

monitor capture CAP int Gi0/0/1 both

monitor capture CAP match ipv4 any any

monitor capture CAP start

show monitor capture CAP buffer brief

monitor capture CAP stop

monitor capture CAP export ftp://10.1.10.27/CAP.pcap

no monitor capture CAP

IOS Router

1. create access-list for packet filter
access-list 1 permit 10.100.1.45
2. create buffer
monitor capture buffer holdpackets
3. filter buffer
monitor capture buffer holdpackets filter access-list 1
4. create capture point
monitor capture point ip cef mytrace all both
5. associate capture point with buffer
monitor capture point associate mytrace holdpackets
6. start capture
monitor capture point start mytrace
• Look at progress
show monitor capture buffer all parameters
• See list of capture points
show monitor capture point all
7. Stop the capture
monitor capture point stop mytrace
8. Export buffer as PCAP
monitor capture buffer holdpackets export tftp://10.1.10.27/mytrace.pcap
9. Remove buffer
no monitor capture buffer holdpackets
10. Remove capture point
no monitor capture point ip cef mytrace all both

Jeff's Blog

Good blog on Cisco  networking and Microsoft stuff



Jeff's Blog