Always Check Your References (Cheat Sheets to the Rescue)

Published: 2015-07-15
Last Updated: 2015-07-15 23:27:02 UTC
by Richard Porter (Version: 2)
3 comment(s)

Most of us have a cheat sheet [CS] here and there. In my jump bag there is a 3 ring binder with cheat sheets in plastic sheet protectors. In this, it got me thinking about cheat sheets again and there are a few things to share. First, we have wrote about them many times over the years (located with Cheat Sheets) [1] [2] [3] [4] [5]. There are also a series of cheat sheets all over the ‘intertubes’ [6] [7] [8] and lets not forget the great list of CS at Packet Life [9]. There are even GIT repositories of CS [10].

Note: From here On, I am talking about an Apple OS X only App. If someone wants to contribute something similar for Linux and Windows email me ( rporter at isc dot sans dot edu ) or twitter @packetalien and I will post an update.

One common thing that has been bothering me as of late is ‘search-ability’ and ease of getting to quick answers in a cheat sheet. Then I thought about possible solutions and wanted to share.

For other coding references there is Dash [11] which I use heavily and they have tons of cheat sheets [12]. While sitting in a SANS 572 Advanced Network Forensics, it hit me, write a Packet Forensics CS, to the Dash Docs Batman.

As it turns out, the format is easy to understand and based in Ruby [12] and there is a Ruby gem called Cheatset [13] that has great samples.

Here is a screenshot of what I’ve got so far, and this cheat sheet will be for packet "forensicators":

There will be more to come as time permits and if anyone is interested in the source or docset for this and or would like to contribute email me ( rporter at isc dot sans dot edu ) or twitter @packetalien.

A final note, when doing forensics on a case, it is always good to have references handy!














Richard Porter

@packetalien,, rporter at isc dot sans dot edu

--- ISC Handler on Duty

3 comment(s)


Personally I find Evernote works well. Premium version with ocr makes a lot of the details searchable and therefore pretty easy to find. Not a plug for Evernote, just sharing what works for me. I have easy access on my various pc's and mobile devices, which makes it handy. As they say your mileage may vary.
I have not tired it, but in a search for a "Dash for Linux/Windows", this came up: Zeal (zealdocs[.]org) It says it is open source and was inspired by Dash. It says it supports the same document sets too.
I find that OneNote works well. Like Evernote it syncs to all devices even Apple phones and pads.

Diary Archives