Recent Posts

Pages: [1] 2 3 ... 10
1
Routing and Switching / Re: Can I SPAN a SPAN?
« Last post by Otanx on Today at 09:23:30 AM »
You can "write" with a normal SPAN on some devices, but it has limitations. It is not the same as being inline which I am sure Dean knows. On a 6500 you can do "monitor session 1 destination Gi1/1/1 ingress" which sets up the switch to accept inbound packets from the SPAN destination. A common use case is to be able to manage a monitoring device over the same port that is collecting the SPAN. You don't see it too often anymore. Most devices will use a separate management interface. However, another use case (and what I think Dean is trying to do) is for injecting data to interrupt communications. As an example. Endpoint A tries to open a http connection to Server 1. My IDS sees the SYN, and wants to stop this connection. It can inject a RST to both sides spoofing the IPs. This will prevent the connection. Another fun one Dean mentioned is DNS hijack. If my device can respond quick enough I can beat the real server to responding to the client, and get my DNS answer into the cache first. Then all your communication goes to the IP I sent, and not the real server.

It isn't a real replacement to being inline, but there are some nifty security tricks you can do with it.

-Otanx
2
Forum Lobby / Re: (TIL) Today I Learned...
« Last post by deanwebb on Today at 09:20:48 AM »
TBH you're probably worse off than with a higher clocked 4/6C. Them xeons don't hit the same heights as a 7700k or 8700k and for gaming workloads, a smaller number of very high freq threads is the go

RAM makes practically no difference once you have 'enough' (which is usually 16Gb)


What are you playing?

16 cores is better than anything my kids have on their student-grade laptops. :lol:

I'm playing Cities:Skylines, EU4, HOI4, Ticket to Ride... not very FPS-intensive games. I need the RAM more than anything for C:S. 64GB does the trick like a dream.
5
The worst job hunting advice ever

[html]

In the February 20, 2018 Ask The Headhunter Newsletter, an HR pro warns unsuspecting readers to avoid getting hurt by bad advice on Ask The Headhunter. Question I’ve been in Human Resources 12 years and I have to say your article Resume Blasphemy

6
Forum Lobby / Re: (TIL) Today I Learned...
« Last post by wintermute000 on Today at 02:17:55 AM »
TBH you're probably worse off than with a higher clocked 4/6C. Them xeons don't hit the same heights as a 7700k or 8700k and for gaming workloads, a smaller number of very high freq threads is the go

RAM makes practically no difference once you have 'enough' (which is usually 16Gb)


What are you playing?
7
Certifications and Careers / Certification and Career Goals for 2018
« Last post by deanwebb on Yesterday at 08:33:22 PM »
Well, it's a new year, we need a new goal thread.  >:D

I'm taking the FCSE class this week, I'll have to pass the test so I can keep working with ForeScout. I plan to pass that test soon, should be fun. It's mostly a cert for ForeScout employees and vendor partners, so it's not for folks that support it at their firm or anything like that.

Career-wise, I want to meet my billable hours goal. Should not be an issue, since I'm booked for some major clients that bought lots of architect time in their POs. But, all the same, if it's a goal on my manager's list, it's a goal on my list.

Looks like I'll also get a chance to learn tons more about Splunk and ServiceNow and how they work with ForeScout.
8
Forum Lobby / Re: (TIL) Today I Learned...
« Last post by deanwebb on Yesterday at 08:25:21 PM »
TIL that a Dell T320 server doesn't take a GeForce 1030 card, but it will take a GeForce 730 just fine.

Also TIL that Windows Server 2016 runs Steam and Steam games just fine, especially if the underlying hardware is running a proper video card instead of the Windows Default Display Driver for the embedded onboard controller.

Also also TIL that a good video card coupled with 16 CPUs and 64GB RAM makes for a helluva gaming rig. :smug:
9
Routing and Switching / Re: Trunking switch
« Last post by ristau5741 on Yesterday at 03:58:21 PM »
post output of show interface gi0/1 trunk on the 2960
and output of show interface fa0/1 trunk on the 3550

would be more helpful than a simple show interface
10
Routing and Switching / Re: Trunking switch
« Last post by fsck on Yesterday at 01:13:47 PM »
Ya, looks like the 2960 doesn't support ISL.  I also confirmed that the VLANs are on both ends.

Both show (notconnect) at the moment because I wouldn't be able to reach the switches if they were connected, to grab the info you asked for.  From what I've read and done in the labs in the past, this should work.

I also saw nothing in the logs on either switch to show the cause of the network dropping or errors.  I swapped cables too just to eliminate a L1 issue.

2960

GigabitEthernet0/1 is down, line protocol is down (notconnect)
  Hardware is Gigabit Ethernet, address is 0023.05f6.8801 (bia 0023.05f6.8801)
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, 100Mb/s, media type is 10/100/1000BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 10:32:41, output 10:32:41, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     386690 packets input, 28647766 bytes, 0 no buffer
     Received 363207 broadcasts (363191 multicasts)
     0 runts, 0 giants, 0 throttles
     2 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 363191 multicast, 0 pause input
     0 input packets with dribble condition detected
     290931 packets output, 53919609 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 unknown protocol drops
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 pause output
     0 output buffer failures, 0 output buffers swapped out




3550

FastEthernet0/1 is down, line protocol is down (notconnect)
  Hardware is Fast Ethernet, address is 0017.5a61.ed83 (bia 0017.5a61.ed83)
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 10:30:40, output 10:30:40, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     290933 packets input, 53921517 bytes, 0 no buffer
     Received 264195 broadcasts (156355 multicasts)
     0 runts, 0 giants, 0 throttles
     1 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 156355 multicast, 0 pause input
     0 input packets with dribble condition detected
     386691 packets output, 28647676 bytes, 0 underruns
     0 output errors, 0 collisions, 1 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out
Pages: [1] 2 3 ... 10