" So last week we had eight down from dual core we're talking about Ethiopia extract and some fun ways to force equal to about a packet captures and this is. This compelled -- to cut down had to show -- okay fine let's show up real quick and unsure about what windows with windows and you've got some locals to take a look at packet captures that look at like and those that monkey here in the middle and back them. Here wireless but it's up. -- You're new for this segment of that and have. Yes. And as to what these -- what -- these things are going to make like this enormous amount of data that we capture. And pass this this stuff."

" Easier all right so. You can do. Packet captures or on the fly analysis with these tools you want. Work and we're Astaro for larger urban dwellers have been love -- and I'm just clicking -- but. You don't really get that good information by. What do you comes."

" And you often -- I I mean but it's just. Here. It really look at it and say -- Well there's a JPEG image somewhere adds it's like in Leo in the lady in red dress and you can't read this story out of union okay cool let's let's get you on how we digest this writes this stuff that for now. But. I do wanna little hammer home -- created this again but. Always -- Because you can send him through all these tools they'll take place. Import package. War -- are you saying you know if if you're if you know you've got your monkey at the corporate network your pineapple coffee shop here on. Don't just you know bring the fun all and the -- it just like to see that to a files ECB downed wires or whatever news. Unless you're trying to do some in line that might he might he specifically. Cookies -- just -- yeah -- sure but that that would require. That's -- let's talk about now that's -- So what do these tools that allow us to easily digest these packet captures or even live --"

" Okay so the first where we're gonna show you news network minor as a free totally -- SourceForge. And it's -- point 87 restore our fourth. Real simple you select the interface either of the socket and when he kept him when he's gotten so you can do this without when he had okay. And we'll hear go with our real time. You start and it's certainly go. I really think about never mind it is it has p.s who have integrated into it has something kind of -- tease in extracting. So here's all the images point NC just it's just a thumbnail okay. But you can get it. So this expected image much the same way that when it on your showing us how to -- executable by -- captured that this is singularly. Rise and it would be -- signatures are here you will look. -- on the files have as well. Other cool things. -- credentials and so what kind of for as you can see here these are. Easy standard credentials as. So. Things depend on how that cookies and a you can sometimes view it. From home and just go and -- Are way toward you know they're better at both for -- this but but I -- I -- the other the other awesome thing that. Never mind is it pulls mean -- so you're looking. For forensic standpoint -- answers longer. Nine times out of ten these days. Power is doing team naps doing street Pete because you buck ninety really easy but I just laziness contains a shift like yours yes you know -- back about coddling our own stuff like at the airport through -- as the State's actions that we can. You know bypass the filters back guys -- as well this this is text that -- is sees any industries what kind of query is. What it resolve to which which is the bread and butter. The cool thing -- you got parameters anything that doesn't. Specifically look like credentials you'll still pull in and showing you. So it might see we're press settings right there and then we'll see your parameters in there -- it's lately he gave up a notch service. So evident highlighted keywords in -- if I wanna look for Daryn going through the wire. Yes seeking get really specific yes you users. Protects. Okay and then this -- put filters on etiquette you know and that's what he was nice and then there's anomalies but. Great the other great thing is that you can just file open your -- captors -- demo. All right so we got an -- password for a sequel -- personalities so. SA NC goes like once you got that governor yeah have to have. That the great thing about network is that when it does all this when it expects the files Texans actually puts it. Insider network -- folder under the IP news and and binders and folders so I'm point that out for -- reason our next who does not yet dismiss -- and now. What you want -- what is next so our next who is an enterprise tool called net witness is actually. Just. I think the last few months maybe three -- four months I'll wait for the electric priesthood but have to register I has yet to answer and it's. If -- this very specific you have to put -- value you know this is happening union."

" Oh you know register and alienated so. But disease this is enterprise will also mean yeah don't like you know big bucks to previously so wouldn't I just -- How are right so let's see some I mean I I expect -- features that you formerly was expenses that are like the 30000. Wow okay so this is like enterprise so let's step that up and obviously pretty face but that's not tell me so far what would we got. So we're gonna go to Democrats and you know party. It's called a collection. In inside it went right that is basically. -- so you know click. Action news conference which is kind of what's the word it's like got him out it and now kind of intimidate. Yeah it's you know you mean the line and vote here there is. It's -- lots you know graphical goodness so I think credit cards. Yeah it looks good says so attachment and has little image so for example somebody emailed someone with an attachment with credit cards attacks -- would."

" Right so the first that the numbers nexus how many times it occurred. They link on this specific item -- you drove down okay so say we want to look at all of the JPEG's. Now it shows -- down in -- so that we can see okay they all came from source tend not going line. They all came in Arlington this nation's 64 winner. Let's go back report. And that's look back at that credit card that -- it one next. This is the cool feature. All right so. You can actually see awful like reunions this you know it was sent to from subject just as if you look really nice. Electability reconstructed. You were. So down at the bottom. And well there's that -- together there's contact mr. there. Her parents that tax I would like to open so you have some options like and -- it's the default. An area and on April this it's. This record. If so. One of the one of the more difficult features is alive and it's always difficult because they kind of hide these ops -- anywhere. --"

" Just playing with the demo I think -- you're saying that we can just turn this on and see the same kind of information in the same -- fashion without the like did the big lying like headlights thing this is the good stuff like found the you know the pop three account or -- ever. So how we see this live in the we have that the monkey go in there we just -- in the month."

" So you can think of Davis well let's let's just do this let's. Start a new collection are caught I've done. Am. Connect to -- sensible local connection. But nothing's happening. So. You kind of look around for hours on and trying to -- What how to get it so how to actually use -- at least he has capture bar. Okay it's captured our cricket and we'll have a partner here. They want to send it. Five demo. But before that. Make sure you set your options under captured does it -- should be an attractive actors and there's our -- win 38 Q adapter. From the interceptor. So while we're still options analyses yet. Application -- look at all these things and so it knows these by default we don't have to create signatures at. So this is the strong part of that witness it knows more. Still signatures since this year's 30000 dollars a year -- you look at this and it's it's cut. And even on -- confidence. No way silly yeah so VoIP call you know what called Skype call it's it's right on the -- Bill Clinton. Nice tour reluctantly she felt it some accent kind of yet to have the whole cancer. A -- from beginning to end. First back on because. It's. Obviously as the aid that would antsy in the -- to zero but what whom you -- earth -- calling. It January and now it's so these are all because it and you can you actually extend this because this is based on your opponent and okay so -- if you have the codec it would show up right ROK so we got our. We learned -- percent. And and okay and the mountainous. Start. Not having not agreeing. You start all right."

" So if I just log over to the forms and images. Log in here with my -- form account. And since it's live you should see it already. It -- to capture. So really can't see elect popularly as its. Now look at. And yeah department let. Here's the thing right you could be running multiple -- have this on one box doing this wires in another -- you can have. Or minor running lines as well so there's no reason why we have to -- this it's. You know land lines. And -- true. Okay. Do it that's it does it really highly goodies -- All right does highlight the you can actually see the page and everything is -- yet."

" Ultimately there. -- It's so I don't know man -- might require some three sessions there's."

" Oh yeah that would be PH -- but of course all the images are absent and that pretty -- that simple you mean. I like the idea being able to easily digest all of that just so -- And -- You know and when -- on -- expeditions with a plan learn something I have I have fun. While I'm there and then -- really think it on the really analyze the pictures of so much going through the wires that there's no way area here at all. The fact that we're going to lead to so many other fun attacks that includes social engineering -- ego like you name it right so what."

" best practices that actually just wires are captured -- easy you know whatever it. You want to do it and you'd you'd just get on Aaron and dump the packet it at the gap it -- number one remember one. Rule number to use all your tools used TC PH that. An argument that entity I hate you expect as -- works project yeah -- next. These are these cross platform. No. Both are when those --"

" There's just isn't but like you said there's no reason why should just put yourself in a little box real Easter polls because of these are good they run when his wife is from windows right exactly I area."

" So. Run your. Right through that witness right through network -- they all get different results knowing gets it right. And if you just do one of -- you're missing something and so. Definitely just go with the."

" as always and you present your tools like all the time -- he still doing little thing over room -- 62 of highlighting -- that's where 2009 -- Monies that we get it gets approved 360 dot com rob thanks so much Ellison you -- regulate these straight and stuff. We gotta fund one got to step it up while god and that. We've we've got another. And other industry and coming up right now but but first we have another on. Little geeky on artistic stuff. And -- had a chance going on. With this week's trivia."

" So last week we had eight down from dual core we're talking about Ethiopia extract and some fun ways to force equal to about a packet captures and this is. This compelled -- to cut down had to show -- okay fine let's show up real quick and unsure about what windows with windows and you've got some locals to take a look at packet captures that look at like and those that monkey here in the middle and back them. Here wireless but it's up. -- You're new for this segment of that and have. Yes. And as to what these -- what -- these things are going to make like this enormous amount of data that we capture. And pass this this stuff."

" Easier all right so. You can do. Packet captures or on the fly analysis with these tools you want. Work and we're Astaro for larger urban dwellers have been love -- and I'm just clicking -- but. You don't really get that good information by. What do you comes."

" And you often -- I I mean but it's just. Here. It really look at it and say -- Well there's a JPEG image somewhere adds it's like in Leo in the lady in red dress and you can't read this story out of union okay cool let's let's get you on how we digest this writes this stuff that for now. But. I do wanna little hammer home -- created this again but. Always -- Because you can send him through all these tools they'll take place. Import package. War -- are you saying you know if if you're if you know you've got your monkey at the corporate network your pineapple coffee shop here on. Don't just you know bring the fun all and the -- it just like to see that to a files ECB downed wires or whatever news. Unless you're trying to do some in line that might he might he specifically. Cookies -- just -- yeah -- sure but that that would require. That's -- let's talk about now that's -- So what do these tools that allow us to easily digest these packet captures or even live --"

" Okay so the first where we're gonna show you news network minor as a free totally -- SourceForge. And it's -- point 87 restore our fourth. Real simple you select the interface either of the socket and when he kept him when he's gotten so you can do this without when he had okay. And we'll hear go with our real time. You start and it's certainly go. I really think about never mind it is it has p.s who have integrated into it has something kind of -- tease in extracting. So here's all the images point NC just it's just a thumbnail okay. But you can get it. So this expected image much the same way that when it on your showing us how to -- executable by -- captured that this is singularly. Rise and it would be -- signatures are here you will look. -- on the files have as well. Other cool things. -- credentials and so what kind of for as you can see here these are. Easy standard credentials as. So. Things depend on how that cookies and a you can sometimes view it. From home and just go and -- Are way toward you know they're better at both for -- this but but I -- I -- the other the other awesome thing that. Never mind is it pulls mean -- so you're looking. For forensic standpoint -- answers longer. Nine times out of ten these days. Power is doing team naps doing street Pete because you buck ninety really easy but I just laziness contains a shift like yours yes you know -- back about coddling our own stuff like at the airport through -- as the State's actions that we can. You know bypass the filters back guys -- as well this this is text that -- is sees any industries what kind of query is. What it resolve to which which is the bread and butter. The cool thing -- you got parameters anything that doesn't. Specifically look like credentials you'll still pull in and showing you. So it might see we're press settings right there and then we'll see your parameters in there -- it's lately he gave up a notch service. So evident highlighted keywords in -- if I wanna look for Daryn going through the wire. Yes seeking get really specific yes you users. Protects. Okay and then this -- put filters on etiquette you know and that's what he was nice and then there's anomalies but. Great the other great thing is that you can just file open your -- captors -- demo. All right so we got an -- password for a sequel -- personalities so. SA NC goes like once you got that governor yeah have to have. That the great thing about network is that when it does all this when it expects the files Texans actually puts it. Insider network -- folder under the IP news and and binders and folders so I'm point that out for -- reason our next who does not yet dismiss -- and now. What you want -- what is next so our next who is an enterprise tool called net witness is actually. Just. I think the last few months maybe three -- four months I'll wait for the electric priesthood but have to register I has yet to answer and it's. If -- this very specific you have to put -- value you know this is happening union."

" Oh you know register and alienated so. But disease this is enterprise will also mean yeah don't like you know big bucks to previously so wouldn't I just -- How are right so let's see some I mean I I expect -- features that you formerly was expenses that are like the 30000. Wow okay so this is like enterprise so let's step that up and obviously pretty face but that's not tell me so far what would we got. So we're gonna go to Democrats and you know party. It's called a collection. In inside it went right that is basically. -- so you know click. Action news conference which is kind of what's the word it's like got him out it and now kind of intimidate. Yeah it's you know you mean the line and vote here there is. It's -- lots you know graphical goodness so I think credit cards. Yeah it looks good says so attachment and has little image so for example somebody emailed someone with an attachment with credit cards attacks -- would."

" Right so the first that the numbers nexus how many times it occurred. They link on this specific item -- you drove down okay so say we want to look at all of the JPEG's. Now it shows -- down in -- so that we can see okay they all came from source tend not going line. They all came in Arlington this nation's 64 winner. Let's go back report. And that's look back at that credit card that -- it one next. This is the cool feature. All right so. You can actually see awful like reunions this you know it was sent to from subject just as if you look really nice. Electability reconstructed. You were. So down at the bottom. And well there's that -- together there's contact mr. there. Her parents that tax I would like to open so you have some options like and -- it's the default. An area and on April this it's. This record. If so. One of the one of the more difficult features is alive and it's always difficult because they kind of hide these ops -- anywhere. --"

" Just playing with the demo I think -- you're saying that we can just turn this on and see the same kind of information in the same -- fashion without the like did the big lying like headlights thing this is the good stuff like found the you know the pop three account or -- ever. So how we see this live in the we have that the monkey go in there we just -- in the month."

" So you can think of Davis well let's let's just do this let's. Start a new collection are caught I've done. Am. Connect to -- sensible local connection. But nothing's happening. So. You kind of look around for hours on and trying to -- What how to get it so how to actually use -- at least he has capture bar. Okay it's captured our cricket and we'll have a partner here. They want to send it. Five demo. But before that. Make sure you set your options under captured does it -- should be an attractive actors and there's our -- win 38 Q adapter. From the interceptor. So while we're still options analyses yet. Application -- look at all these things and so it knows these by default we don't have to create signatures at. So this is the strong part of that witness it knows more. Still signatures since this year's 30000 dollars a year -- you look at this and it's it's cut. And even on -- confidence. No way silly yeah so VoIP call you know what called Skype call it's it's right on the -- Bill Clinton. Nice tour reluctantly she felt it some accent kind of yet to have the whole cancer. A -- from beginning to end. First back on because. It's. Obviously as the aid that would antsy in the -- to zero but what whom you -- earth -- calling. It January and now it's so these are all because it and you can you actually extend this because this is based on your opponent and okay so -- if you have the codec it would show up right ROK so we got our. We learned -- percent. And and okay and the mountainous. Start. Not having not agreeing. You start all right."

" So if I just log over to the forms and images. Log in here with my -- form account. And since it's live you should see it already. It -- to capture. So really can't see elect popularly as its. Now look at. And yeah department let. Here's the thing right you could be running multiple -- have this on one box doing this wires in another -- you can have. Or minor running lines as well so there's no reason why we have to -- this it's. You know land lines. And -- true. Okay. Do it that's it does it really highly goodies -- All right does highlight the you can actually see the page and everything is -- yet."

" Ultimately there. -- It's so I don't know man -- might require some three sessions there's."

" Oh yeah that would be PH -- but of course all the images are absent and that pretty -- that simple you mean. I like the idea being able to easily digest all of that just so -- And -- You know and when -- on -- expeditions with a plan learn something I have I have fun. While I'm there and then -- really think it on the really analyze the pictures of so much going through the wires that there's no way area here at all. The fact that we're going to lead to so many other fun attacks that includes social engineering -- ego like you name it right so what."

" best practices that actually just wires are captured -- easy you know whatever it. You want to do it and you'd you'd just get on Aaron and dump the packet it at the gap it -- number one remember one. Rule number to use all your tools used TC PH that. An argument that entity I hate you expect as -- works project yeah -- next. These are these cross platform. No. Both are when those --"

" There's just isn't but like you said there's no reason why should just put yourself in a little box real Easter polls because of these are good they run when his wife is from windows right exactly I area."

" So. Run your. Right through that witness right through network -- they all get different results knowing gets it right. And if you just do one of -- you're missing something and so. Definitely just go with the."

" as always and you present your tools like all the time -- he still doing little thing over room -- 62 of highlighting -- that's where 2009 -- Monies that we get it gets approved 360 dot com rob thanks so much Ellison you -- regulate these straight and stuff. We gotta fund one got to step it up while god and that. We've we've got another. And other industry and coming up right now but but first we have another on. Little geeky on artistic stuff. And -- had a chance going on. With this week's trivia."