Featured Posts

An alert touches multiple segments of the network, representing the challenge to reduce false positives
Deep Network Observability

How to Reduce False Positives with Shared Context

False positives are rarely caused by too many alerts, but by missing context. Let’s say a spike in outbound traffic shows up in the firewall logs. Around the same time, ...

Read More
Magnifying glass on top of a diagram that looks like both a fingerprint and a network, representing end-to-end network troubleshooting
Network Operations

Why Most Performance Investigations Start in the Wrong Place

A padlock silhouetted against a dark background, surrounded by a spray of white particles, representing password spraying detection.
Security Operations

What Password Spraying Looks Like in Raw Network Telemetry

All Posts

Digital hourglass with data falling, representing application performance metrics
Network Operations

Application Performance Metrics: Best Practices and Insights

Application performance has a large impact on the efficiency and success of an organization. Users expect fast, seamless, and

Read More
jeffm
General

Inspecting encrypted traffic with JA3 and JA3S fingerprinting

Two years ago, I wrote a blog about tracking malware in encrypted traffic. The overall theme of that blog

Read More
Network Operations

Network Problem Solving Use Cases

In the last year I’ve been fortunate enough to be a Field Engineer for a company that I love.

Read More
Netflow

Find Pokemon GO Network Traffic with NetFlow

Monitor Pokemon Go Network Traffic So there I am monitoring my network with NetFlow and a wild application appears!

Read More
Network Operations

Configure a mirror port in VMware

Today, I’d like to walk you through the process to configure a mirror port in VMware’s VSphere.  After you’ve

Read More