The Ultimate Guide to Secure Troubleshooting and Diagnostics

Password Auditing and Packet Sniffers

Cyber security professionals use specialized tools to evaluate passwords and monitor networks. They know that weak passwords can jeopardize an entire network and the critical data that it manages. Using password auditing techniques, system administrators and analysts can monitor passwords and determine their strength against hacking attempts.

John the Ripper is a tool used to test the strength of passwords quickly and efficiently, to minimize the likelihood of a weak password putting a network at risk.

Hashcat is a password-cracking tool used by penetration testers and system administrators. Password hashing is a method of protecting passwords by converting them into a series of random characters, known as a hash (this process is different from encryption, which is used to conceal information). The software essentially guesses a password, hashes it and compares the hash to the one it’s trying to crack.

A packet sniffer, also known as a packet analyzer, protocol analyzer or network analyzer, is a hardware or software tool used to monitor network traffic.

Wireshark is a console-based cyber security tool (previously known as Ethereal) used to study network protocols and analyze network security in real time.

Tcpdump is a network data packet-sniffing program used by cyber security pros to monitor and log TCP (Transmission Control Protocol) and IP (Internet Protocol) traffic that passes across a computer network.

Snort is an open-source intrusion protection system that can be used as a packet sniffer (like tcpdump), as a packet logger, or as a fully deployed network intrusion prevention system. This program can be downloaded and configured for either business or personal use.

Network Security Monitoring

Through the use of network monitoring software, administrators can determine if a network is running optimally and proactively identify deficiencies. Network monitoring provides a clear picture of all the connected devices on a network, allowing system administrators to see how data is moving between them and quickly correct any flaws that could undermine network performance or lead to outages.

Types of network monitoring protocols include:

SNMP: The Simple Network Management Protocol uses a call and response system to check the status of devices such as switches and printers, and can be used to monitor system status and configuration.

ICMP: Routers, servers and other network devices use the Internet Control Message Protocol to send IP operations information and generate messages when devices fail.

Cisco Discover Protocol: This protocol facilitates management of Cisco devices by discovering them, determining how they are configured and allowing systems using different network-layer protocols to learn about one another.

ThousandEyes Synthetics: An internet-aware synthetic monitoring system that detects modern networked application performance issues.

Vulnerability Scanners

Vulnerability scanners help organizations determine what cyber security threats they may be facing as a result of vulnerabilities detected across their IT infrastructure. Organizations often use multiple vulnerability scanners to ensure they are getting a clear assessment of threats. A sampling of these cyber security tools includes:

Acunetix: This web vulnerability scanner features advanced crawling technology that enables it to uncover vulnerabilities to search every type of web page, even pages that are password protected.

Nessus: Downloaded more than 2 million times worldwide, Nessus provides thorough coverage and scans for more than 59,000 common vulnerabilities and exposures (CVEs).

Burp Suite: With multiple scanning, integration and reporting features, Burp Suite is a vulnerability scanner that integrates with bug tracking systems like Jira and is frequently updated.

GFI Languard: A vulnerability scanner for network and web applications that can automatically deploy patches across operating systems, web browsers and third-party applications.

Tripwire IP360: A scalable vulnerability scanning tool that can scan an organization’s total environment, including previously-undetected assets.

Network Intrusion Detection

To improve protection against malicious IP traffic on their networks, organizations often use intrusion detection and protection systems (IDPS) to safeguard against threats that may penetrate their firewalls. Intrusion detection systems (IDS) use software to automate the detection process and intrusion protection systems (IPS) use software to detect and attempt to deter potential data breaches. Once a malicious pattern or violation is detected, the IDS alerts the system administrators so they may take appropriate action. The IPS analyzes IP traffic and blocks malicious traffic, thereby preventing an attack.

According to the National Institute of Standards and Technology (NIST), there are 4 classifications of IDPS technologies:

Network-based: These IDPS technologies monitor network traffic for particular network segments or devices and analyze the network and application protocol activity to identify suspicious activities.

Wireless: Wireless IDPS technologies monitor and analyze traffic on wireless networks to identify suspicious activity involving wireless networking protocols.

Network behavior analysis (NBA): NBA examines network traffic to identify threats generating unusual traffic flows, such as distributed denial of service (DDoS) attacks or certain forms of malware.

Host-based: Host-based IDPS technologies monitor the characteristics of a single host (a PC or server, for example) and the events occurring within that host for suspicious activity.

Encryption Tools

Playing an essential role in safeguarding data that is stored or transmitted, encryption is a process that scrambles readable text so it can only be read by the person who has the decryption key. Vast amounts of personal information – bank accounts, credit card profiles, health records and more – are managed online and stored in the cloud or on servers connected to the internet.

Encryption scrambles readable text it into an unreadable format called cypher text. When the intended recipient opens the message, the information is decrypted, or converted back into its readable form. To make this happen, the sender and recipient both have to use an encryption key, which is a collection of algorithms that do the scrambling and unscrambling.

Examples of encryption algorithms in use today include:

Triple DES: Strengthening the original DES (Data Encryption Standard), which was established in 1977 and is now considered too weak to protect sensitive data, Triple DES runs encryption 3 times – encrypting, decrypting and encrypting again.

RSA: Taking its name from the initials of its 3 computer scientist inventors (Rivest, Shamir and Adleman), RSA uses a strong and widely used algorithm for encryption. It is popular because of its key length and commonly used for secure data transmission.

Advanced Encryption Standard (AES): Used worldwide, AES has been the U.S. government standard since 2002.

TwoFish: This free encryption software is used in hardware and software. It is considered to be one of the fastest encryption algorithms.

Does Cyber Security Use Hardware or Software?

Cyber security professionals use a combination of both hardware and software to build security. While a good portion of their work does include the use of cyber security tools like anti-virus software or firewalls, using the correct type of hardware to build networks and infrastructure is important, too. Just as they make recommendations for new security software upgrades, a cyber security professional can recommend that a company upgrade its hardware if it’s incapable of supporting the software.

• Cyber Security Mastery: 9 Tools, Techniques You Need to Know

• Cybersecurity Basics: How to Protect Your Digital Today

• Next-Gen Modern Computing: The Ultimate Vision and Challenge

• The Ultimate Guide to Cybersecurity: What You Need to Know

• Cybersecurity Explained: Everything You Need to Know in 2026