Tims Blog

Too many cool new things to make use of

• malware forge
• tcpurify
• netwitness investigator
• merging pcap files
• scapy
• pyflag
• honeysnap
• extracting email attachments from pcap files
• striping files out of pcap with wireshark
• networkminer
• rtgraph3d

My entire day is spent dealing with software that is beyond maddening.

Search, packet capture, network services, databases, etc. They all are hopelessly useless in their implementations on site, and I’ve lost my faith that any of them can actually be done even marginally well. I’m crying out for even C grade quality, heck with the B or A quality work.

For example, the performance of a web service interface that I’ve used recently.

Now, logic would dictate that APIs of nearly every make and model are better off not existing if the performance of them is slow. Laemly slow. Slower than a blind, crippled, geriatric turtle competing in the Chicago marathon.

Yet they exist

I’m sitting here in fact, waiting for a call to said API to finish. How long have I been sitting? well, wget timed out at the 15 minute mark, and re-initiated the request. Does that, to you, sound like a good API?

And to rub salt in the wound (no offense to the salt) the API is a web services API. In my experience, anything that would match the regex /web/ is immediately assumed to be quick, snappy, anti-Bill Lumberg speak. To take 15 minutes is unacceptable; don’t argue with me, it’s unacceptable.

So it makes it difficult to build anything on top of solutions like this. You see a cool product, say “hooray a solution to my problem” and then are immediately let down when you find out that, no, you were wrong because they tricked you into thinking that their super awesome tool is really just a web service wrapper around “cat directory/* | grep $string”. Lame.

It leaves me wondering where all the smart folks have run off to. Surely there have to be some brilliant engineers that have solved these problems before. Hopefully they are not all living in a town secluded in a Colorado mountain valley.

If they are, we’re all screwed.

Well, I promised some nessquik beta code by the end of October, but I missed my mark. It’s close to being ready, but I haven’t walked through a successful cradle-to-grave install yet, so I don’t want to release any code just yet.

I worked on it more this weekend to get it to the point of release-ness though. The setup module is finished and I fixed a number of quirks and bugs I found as I ran through god know how many installations.

I also need to complete at least 2 install docs; one for ubuntu, one for a RHEL based distro, before I’ll upload a beta. I’ve started with the Ubuntu one first, basing it off Jaunty because Karmic just came out.

I don’t have software to give, but I won’t leave you hanging. So here are a boatload of screenshots that show off the new nessquik.

If  you’d like to be notified when the beta is available, shoot me an email at my caphrim007 google account, or follow me on twitter and I’ll post an update then.

Until then, enjoy the screenshots