Category Archives: PacketCapture

17 October, 2026

Deploying Cisco TRex: A Line-Rate Traffic Generator for Your Firewall Lab

Deploy Cisco TRex traffic generator on Ubuntu to test FortiGate throughput. Run stateless and stateful tests with Python automation for accurate lab results.

8 October, 2026

Red Team Tool Series: “tcpflow” Read the Conversation, Not the Packets

Use tcpflow to reassemble TCP streams into readable files. Learn to carve HTTP objects, parse DFXML reports, and analyze FortiGate captures with this practical...

24 August, 2026

Replaying PCAPs in Scapy: Packet Injection, Address Rewriting, and Timing-Accurate Retransmission

Replay PCAP with Scapy using raw socket injection. Learn to rewrite IP addresses, recalculate checksums, and pace packets accurately for lab testing.

1 August, 2026

TCP Flags Deep Dive: Meaning, Behavior, and Troubleshooting

Master TCP flags meaning and troubleshooting. Learn to read raw packet captures, diagnose handshake failures, and correlate wire behavior with FortiGate session states.

31 July, 2026

FortiGate Packet Capture: The Complete Advanced Filter Syntax Reference

Master FortiGate packet capture filter syntax. Use BPF filters in the GUI or CLI to isolate traffic by host, port, protocol, and TCP flags.

28 July, 2026

Removing NAG Screen on Wireshark 4.6.7

Disable the Wireshark nag screen and donation prompts in v4.6.7. Learn to edit the recent file or use Welcome settings to stop ads on...

30 June, 2026

Building Custom Application Signatures on FortiGate

Create a FortiGate custom application signature to identify unknown traffic. Learn F-SBID syntax, find unique fingerprints, and apply the signature in firewall policies.

22 June, 2026

Deploying Cacti with NetFlow Support on Ubuntu Linux: Configuring Cisco, Fortinet and Juniper for Netflow

Deploy Cacti NetFlow configuration using the FlowView plugin on Ubuntu. Configure Cisco, Fortinet, and Juniper devices to export flow data for traffic analysis.

25 February, 2026

Basics of Wireshark – Session 5 – Address Resolution, GEO IP, and Annotations

Learn how to resolve IP addresses, enable GeoIP lookups, and add persistent annotations to pcapng files in Wireshark for better traffic analysis.

25 February, 2026

Basics of Wireshark – Session 4 – Where to Capture From

Configure Wireshark port mirroring on FortiGate, Cisco, and Juniper devices. Learn to capture PCAPs from switches and firewalls for accurate network troubleshooting.

24 February, 2026

Basic of Wireshark – Session 3 – Capture vs Display Filters

Learn the difference between Wireshark capture and display filters. Master BPF syntax for capture filters and Wireshark-specific logic for display filters to reduce noise.

23 February, 2026

Basics of Wireshark – Session 2 – Ring Buffers, Color Schemes and CLI Tools

Configure Wireshark ring buffers for long-term captures. Compare pcap vs pcapng formats and apply color schemes to analyze network traffic efficiently.

22 February, 2026

Basics of Wireshark – Session 1 – Setting up your Wireshark Install

Learn how to install Wireshark on macOS. Configure ChmodBPF for safe packet capture and add tools to your system path for easy terminal access.

31 March, 2020

How I use Wireshark in My Daily Grind

Master Wireshark capture filters and display filters to isolate traffic. Learn exclusion, inclusion, and string search techniques for faster network troubleshooting.

9 February, 2020

SPAN and RSPAN On Cisco Switches

Learn Cisco switch SPAN configuration to mirror traffic for packet capture. Includes standard SPAN and RSPAN setup commands for network troubleshooting.

2 February, 2020

Packet Capture on FortiSwitch

Configure FortiSwitch packet capture via CLI. Learn to enable port sampling, run diag sniffer, and export raw data to PCAP for network troubleshooting.

8 May, 2019

Creating SPAN port on Fortigate By: Brent Klespies

Learn how to create a SPAN port on FortiGate for IDS providers. Configure hardware switches and port mirroring on entry-level models like the 400E.

21 March, 2019

Fortigate in One-Arm Sniffer Mode

Configure Fortigate one-arm sniffer mode for passive traffic analysis. Includes Cisco switch monitor session setup and CLI commands for sniffer profiles.