How long did it take you to write "Practical Packet Analysis" and what was it like? Any major difficulties?
Start to finish, writing PPA took about eight months. This was my first in print book and it really was a lot of work. I used to think that I wrote to teach people, but I've come to learn that I probably learn just as much writing about technical topics as people do reading them. The guys at No Starch were absolutely fantastic to work with and they let me work at my pace and do things my way, which made it that much better for a first time writer. It was a really fun project and I met a lot of really great people in the Wireshark community while doing it. I can't wait to write a follow up to it.
What's the most interesting fact you've become aware of while researching for your book?
Since writing this book, I've gotten a lot of e-mail from different people asking for assistance regarding packet analysis problems they encounter, which I'm always glad to offer some insight into. The funny thing is, a lot of these e-mails reference me as a "Wireshark Expert", which I find kind of funny. Throughout the course of my book research I've come to figure out that anybody can be a Wireshark expert. It's really just a program with a lot of different analysis tools in it. What makes someone really good at packet analysis is being an expert at the underlying protocols that make a network function. Just because I know how to create an IO graph or chart RTT times doesn't mean that I understand how to follow the packet sequence of a DHCP zone transfer or figure out what a particular ICMP error code is. Packet analysis is no more centered on Wireshark as Astronomy is centered on a telescope. Sure, you need to know how to use the tool, but that tool is just a gateway into everything else you need to learn.
What are your future plans? Any exciting new projects?
I'm hoping to eventually write a second edition of PPA which will have quite a few more practical scenarios which should be beneficial to new PPA readers as well those who bought the first edition. Aside from that I continue to post new content to my blog related to both packet analysis and other topics that are of interest to network administrators. Speaking of which, you can check that out here.