Skip to content

Instantly share code, notes, and snippets.

View dancwilliams's full-sized avatar
🎪
The Show

Dan C Williams dancwilliams

🎪
The Show
10 followers · 7 following
  • New Orleans, LA
View GitHub Profile
@dancwilliams
dancwilliams / VRF_VLAN_Breakdown
Created June 14, 2017 14:00
╔═══════════╦═════════════════════╦═════════╦═════════════════╦═══════════════════════╗
║ VRF Name ║ Route Distinguisher ║ VLAN ID ║ IP Address ║ Description ║
╠═══════════╬═════════════════════╬═════════╬═════════════════╬═══════════════════════╣
║ WAN ║ 99 ║ N/A ║ 10.20.30.253/24 ║ Internet ║
║ Accessred ║ 1 ║ 1 ║ 192.168.1.1/24 ║ Tenant 1 ║
║ blue ║ 2 ║ 2 ║ 192.168.2.1/24 ║ Tenant 2 ║
║ green ║ 3 ║ 3 ║ 192.168.1.1/24 ║ Tenant 3 — Dup Red IP ║
║ voice ║ 111 ║ 111 ║ 10.1.1.1/24 ║ Shared Voice ║
║ N/A ║ N/A ║ 999 ║ 10.9.9.1/24 ║ Management ║
╚═══════════╩═════════════════════╩═════════╩═════════════════╩═══════════════════════╝
@dancwilliams
dancwilliams / GS_IPs.txt
Created January 5, 2017 19:56
GRIZZLY STEPPE IPs within https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity
101.64.234.86
101.98.11.146
103.16.152.10
103.21.198.13
103.226.132.7
103.23.136.10
103.244.164.3
103.253.41.55
103.254.108.7
103.254.16.168
@dancwilliams
dancwilliams / gist:8d80aa258f3c886de5571f2f01902d46
Created January 5, 2017 19:53
GRIZZLY STEPPE Reverse DNS from IPs within https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity
em1-112-1-1.pool.e-mobile.ne.jp
proxysrv1.flat33.co.nz
mrtg.bsccl.com
cacti.mega.com.kh
cacti-sa.unisel.edu.my
pro2.internet-webhosting.com
host-104-128-161-233.VALOLT4.epbfi.com
104.207.130.126.vultr.com
c999947929-cloudpro-972761167.cloudatcost.com
drew010-relay01.drew-phillips.com
@dancwilliams
dancwilliams / gist:b78dbb3b87cc0455f666
Created April 26, 2015 14:29
Suricata-ALL
{
"index": {
"default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED",
"pattern": "[logstash-]YYYY.MM.DD",
"warm_fields": true,
"interval": "day"
},
"style": "light",
"rows": [
{
@dancwilliams
dancwilliams / suricata_eve_mgmt.sh
Last active August 29, 2015 14:13
pfSense - Suricata eve.json mangement TEST
#!/bin/sh
# This script is used to copy the eve.json file to the /usr/local/www/ directory, delete the current file, and create a blank one.
# THIS IS A TEST SCRIPT!!! NOT FOR PRODUCATION USE!!! USE AT YOUR OWN RISK!!!
cp /var/log/suricata/suricata_bge022807/eve.json /usr/local/www/
#echo "Copying File"
#rm /var/log/suricata/suricata_bge022807/eve.json
@dancwilliams
dancwilliams / suricata_dash
Last active August 29, 2015 14:13
Suricata dsh
{
"title": "Suricata EVE Dashboard",
"services": {
"query": {
"list": {
"0": {
"query": "event_type:http",
"alias": "HTTP",
"color": "#7EB26D",
"id": 0,
@dancwilliams
dancwilliams / pfSense22_GeoIP
Last active August 29, 2015 14:13
Added GeoIP Better Map
{
"title": "PFSense Firewall - TEST",
"services": {
"query": {
"idQueue": [],
"list": {
"0": {
"query": "tags: \"PFSense\" AND action: \"pass\"",
"alias": "Passed",
"color": "#6ED0E0",
@dancwilliams
dancwilliams / Syslog Dashboard
Created January 6, 2015 20:30
{
"title": "Syslog Dashboard",
"services": {
"query": {
"list": {
"0": {
"query": "*",
"alias": "Syslog",
"color": "#7EB26D",
"id": 0,
@dancwilliams
dancwilliams / PFSense Firewall
Created January 6, 2015 20:28
{
"title": "PFSense Firewall",
"services": {
"query": {
"idQueue": [],
"list": {
"0": {
"query": "tags: \"PFSense\" AND action: \"pass\"",
"alias": "Passed",
"color": "#6ED0E0",