Last Updated: 2015-07-15 23:27:02 UTC
by Richard Porter (Version: 2)
Most of us have a cheat sheet [CS] here and there. In my jump bag there is a 3 ring binder with cheat sheets in plastic sheet protectors. In this, it got me thinking about cheat sheets again and there are a few things to share. First, we have wrote about them many times over the years (located with site:isc.sans.edu Cheat Sheets)     . There are also a series of cheat sheets all over the ‘intertubes’    and lets not forget the great list of CS at Packet Life . There are even GIT repositories of CS .
Note: From here On, I am talking about an Apple OS X only App. If someone wants to contribute something similar for Linux and Windows email me ( rporter at isc dot sans dot edu ) or twitter @packetalien and I will post an update.
One common thing that has been bothering me as of late is ‘search-ability’ and ease of getting to quick answers in a cheat sheet. Then I thought about possible solutions and wanted to share.
For other coding references there is Dash  which I use heavily and they have tons of cheat sheets . While sitting in a SANS 572 Advanced Network Forensics, it hit me, write a Packet Forensics CS, to the Dash Docs Batman.
As it turns out, the format is easy to understand and based in Ruby  and there is a Ruby gem called Cheatset  that has great samples.
Here is a screenshot of what I’ve got so far, and this cheat sheet will be for packet "forensicators":
There will be more to come as time permits and if anyone is interested in the source or docset for this and or would like to contribute email me ( rporter at isc dot sans dot edu ) or twitter @packetalien.
A final note, when doing forensics on a case, it is always good to have references handy!
@packetalien, packetalien.com, rporter at isc dot sans dot edu
--- ISC Handler on Duty