Home > Packet Analysis, Publications > No Starch Press Presents “Hacking Packets with Wireshark”

No Starch Press Presents “Hacking Packets with Wireshark”

August 14th, 2006 Leave a comment Go to comments

I have just signed my second book deal, this time with No Starch Press (distributed by O’Reilly). The book will be called “Hacking Packets with Wireshark” and will be based on my Packet School 101 series. My scheduled completion date is around February and I am looking at something along the lines of 250-300 pages. This being said, what do you guys want to see in this book? I am open to any and all suggestions so don’t hold anything back!

Categories: Packet Analysis, Publications Tags:
  1. Melissa
    August 17th, 2006 at 08:41 | #1
    Reply | Quote

    Enjoyed your packet school 101 series. I would like to see more analytical techniques relating to information security threats. Hidden payloads, unusal activity on UDP ports, and rootkits. I’ve seen a few articles on NIDS for rootkits, but nothing concrete.

    Thanks!

  2. SC
    August 17th, 2006 at 22:44 | #2
    Reply | Quote

    Hi Chris,

    Great series on packet analysis. I second Melissa’s thought on having more coverage on network security and forensics using packet analysis.

    Look forward. Thanks.

  3. Phil
    August 22nd, 2006 at 07:57 | #3
    Reply | Quote

    Hi Chris,
    As everyone else I must say the packet school 101 was very educational. I am looking forward to the book. I also agree with Melissa’s request for the forensic aspect. But I would also like to see some indepth information on what the protocols really mean. Not the usuall MSBS “Q:What is the protocol TCP?” “Microsoft type Answer: The TCP ip protocol is the Transmission Control Protocol” but rather the real world laymens reason as to why we see it and its significance.

    Thanks,
    Phil

  4. Raj
    December 27th, 2006 at 09:15 | #4
    Reply | Quote

    Hi Chris,
    Season’s greetings.

    I am going through packet school 101, and find practical examples with trace files useful. So how about trace examples of runts and giants? Maybe discussion on whys and how does runt/giant happen in a network?

    Also how to sniff Layer 2/VLAN segments, which much more common in enterprises? You mention in your podcast either to use ARP poisioning or port mirroring – examples of ARP poisioning would be useful. :)

    What I would really apperciate is why and how to set up filters – a step-by-step procedure to look at either telnet or ftp connections between 2 end points with other trafic filtered and or not captured in trace?

    Thanks.
    Regards,
    Raj

  5. Aaron
    January 4th, 2007 at 21:22 | #5
    Reply | Quote

    I’ve only read one of your “101′s” but I enjoyed it. Thanks for taking the time to offer your knowledge.

    Could you include not just the cowboy/Indian (network admin/hacker) scenarios, but also less suspicious topics such as how to analyze and resolve slow networks.

    I am quite the n00b with packet analysis but want to learn more.

    Thanks,

  1. No trackbacks yet.