Multipath TCP detection: what defenders can see on the network
Explainer1 min read
A SANS diary explains how Multipath TCP appears in packet inspection and why identifying the protocol differs from detecting an exploit.
Guides
Practical explainers for learners and defenders.
Monday 2 November 2026
OneNote extraction update helps analysts process embedded files in batches
Explainer1 min read
Didier Stevens has added JSON output to onedump.py, allowing analysts to process embedded files from multiple OneNote documents more efficiently.