As an aside, I was thinking about something similar to this tool for a while now after seeing this post (https://news.ycombinator.com/item?id=46723990) where someone was using Claude to troubleshoot a PCAP. It made me think that it would be nice just to have a nice collection of tshark one-liners to quickly weed out any weird stuff right off the bat. I would assume that it would be a lot more performant than using a LLM and more scalable if you have large PCAP files.

https://youtu.be/o3p81V6IuWk

Quoted for truth. I still take taxis from time to time if there’s no wait at a taxi stand at an airport or building. I noticed in places like Las Vegas things seem better now, there’s flat rates and everyone has touchscreen payment terminals in the passenger area. I remember pre-Uber occasionally getting cab drivers that would take suboptimal routes like getting on the freeway to drive up the meter.

As someone who is on the other side of the fence on this and trying to keep the network secure and preventing data exfiltration there could be a good reason for this. More often than not we have folks doing all kinds of crazy things and ignore what’s in the handbook. For example we had someone who didn’t like MFA for remote access and would use Tailscale to have a remote permanent reverse proxy to their homelab to do whatever work they were doing. What’s funny is that we are not BOFH’s and would have helped them setup whatever they need had they just sent us an email or opened a ticket.