💻 Power User Defense
Advanced Monitoring & Threat Detection
You've mastered the basics. Now learn to monitor your network, detect threats in real-time, and use advanced tools that security professionals rely on.
This Guide Is For You If...
- You've completed Essential Defense and want to level up
- You're comfortable with command-line tools and technical documentation
- You want to actively monitor your network for threats
- You're interested in understanding HOW attacks work, not just preventing them
- You want visibility into what's happening on your devices and network
⚠️ Prerequisites
You must complete Essential Defense first. This guide assumes you already have:
- Password manager with strong unique passwords
- Two-factor authentication on all important accounts
- Automatic backups configured
- Secure home WiFi network
✅ What You'll Achieve
- Real-time network traffic monitoring
- Ability to detect suspicious activity before it becomes a breach
- Understanding of what data your devices are sending
- Advanced privacy tools (VPN, encrypted DNS, Tor)
- Packet analysis skills for investigating threats
Set Up Network Monitoring
Time: 1-2 hours | Cost: Free-$50
Network monitoring lets you see every device on your network and what they're communicating with. This is your early warning system for compromised devices or suspicious activity.
Recommended Tools
Pi-hole
Free (Raspberry Pi $35)Network-wide ad blocking and DNS monitoring. See every DNS query on your network.
Wireshark
FreeIndustry-standard packet analyzer. Capture and inspect network traffic in detail.
GlassWire
Free / $49Beautiful network monitoring for Windows/Android. Real-time alerts for new connections.
Setup Steps
- Install Pi-hole - Set up on Raspberry Pi or Docker container
- Configure DNS - Point your router to Pi-hole as DNS server
- Review query logs - Check what domains your devices are contacting
- Create blocklists - Block tracking, ads, and malicious domains
- Set up alerts - Get notified of unusual DNS patterns
💡 What to Look For
- Unknown devices appearing on your network
- Devices contacting suspicious domains
- Unusual traffic volumes or patterns
- Connections to known malware C2 servers
- Devices "phoning home" when they shouldn't be
💡 Ethernet vs WiFi
For maximum security and performance, use ethernet whenever possible:
- No wireless attacks - Immune to WiFi sniffing, evil twin, and deauth attacks
- Better performance - Lower latency, higher bandwidth, no interference
- Easier monitoring - Simpler network topology, clearer packet captures
- Physical security - Attacker needs physical access to your network
If you must use WiFi, ensure WPA3 encryption, strong passwords, and regular monitoring. Consider ethernet for stationary devices (desktop, NAS, security cameras).
Implement VPN & Encrypted DNS
Time: 1 hour | Cost: $30-60/year
A VPN encrypts all your internet traffic and hides your IP address. Encrypted DNS (DoH/DoT) prevents ISPs and others from seeing which websites you visit.
VPN Recommendations
Mullvad
€5/monthPrivacy-focused, no logs, anonymous payment options. No account required.
ProtonVPN
Free / $48/yearSwiss privacy laws, open-source, free tier available. Secure Core routing.
WireGuard
Free (self-hosted)Modern VPN protocol. Fast, secure, minimal attack surface. DIY setup.
Encrypted DNS Setup
- Choose DNS provider - Quad9, Cloudflare, or NextDNS
- Enable DoH/DoT - Configure in browser or system settings
- Test for leaks - Use dnsleaktest.com to verify
- Configure router - Apply DNS settings network-wide
⚠️ VPN Limitations
VPNs don't make you anonymous. They hide your traffic from your ISP and local network, but the VPN provider can see everything. Choose a provider with a verified no-logs policy.
Upgrade to Hardware Security Keys
Time: 30 minutes | Cost: $25-50
Hardware security keys (like YubiKey) provide phishing-resistant 2FA. Even if you enter your password on a fake site, the key won't authenticate because it verifies the domain.
Recommended Keys
YubiKey 5C NFC
$55USB-C + NFC. Works with phones and computers. Supports FIDO2, U2F, OTP.
Google Titan
$30Budget option. USB-A + NFC. FIDO2 certified. Good for Google accounts.
Nitrokey
$29-109Open-source hardware and firmware. Made in Germany. Various models.
Setup Priority
- Buy 2 keys - One primary, one backup (store separately)
- Register with password manager - Bitwarden, 1Password support FIDO2
- Add to email accounts - Gmail, Outlook, ProtonMail
- Enable on financial accounts - Banks, brokerages, crypto exchanges
- Secure social media - Twitter, Facebook, GitHub
💡 Pro Tip
Register both keys with every account immediately. If you lose your primary key, you'll still have access via the backup. Store the backup key in a different physical location.
Learn Basic Packet Analysis
Time: 2-3 hours | Cost: Free
Wireshark lets you capture and analyze network packets. This skill is invaluable for investigating suspicious activity and understanding what your devices are really doing.
Essential Wireshark Skills
- Capture traffic - Select interface and start capturing packets
- Apply filters - Focus on specific protocols (http, dns, tcp)
- Follow TCP streams - Reconstruct full conversations
- Identify protocols - Recognize HTTP, HTTPS, DNS, SMTP patterns
- Spot anomalies - Unusual ports, unexpected connections, malformed packets
Common Filters
httpShow all HTTP traffic (unencrypted web browsing)
dnsShow all DNS queries (what domains are being looked up)
ip.addr == 192.168.1.100Show traffic to/from specific device
tcp.port == 443Show HTTPS traffic (encrypted web browsing)
⚠️ Legal Note
Only capture traffic on networks you own or have explicit permission to monitor. Intercepting others' traffic without consent is illegal in most jurisdictions.
Advanced Privacy Tools
Time: 1-2 hours | Cost: Free
These tools provide additional layers of privacy and security for high-risk scenarios.
Privacy Tool Stack
Tor Browser
FreeAnonymous browsing through Tor network. Use for sensitive research or whistleblowing.
Signal
FreeEnd-to-end encrypted messaging. Open-source, recommended by security experts.
VeraCrypt
FreeCreate encrypted containers for sensitive files. Plausible deniability features.
Tails OS
FreeLive OS that routes all traffic through Tor. Leaves no trace on computer.
When to Use These Tools
- Tor Browser - Researching sensitive topics, accessing blocked content, whistleblowing
- Signal - Communicating with sources, discussing sensitive matters, organizing protests
- VeraCrypt - Storing sensitive documents, protecting data on laptops, border crossings
- Tails OS - High-risk journalism, activism in hostile environments, maximum privacy needs
💡 Operational Security (OpSec)
Tools alone don't guarantee privacy. Practice good OpSec:
- Don't mix anonymous and real identities
- Use separate devices for sensitive work
- Assume all communications can be compromised
- Trust no one with sensitive information
What You're Protected Against Now
- ✅ Network-level attacks - You can detect and block suspicious traffic
- ✅ ISP surveillance - Your traffic is encrypted via VPN
- ✅ DNS hijacking - Encrypted DNS prevents manipulation
- ✅ Phishing attacks - Hardware keys prevent credential theft
- ✅ Compromised devices - Network monitoring reveals infected devices
- ✅ Man-in-the-middle attacks - VPN and encrypted DNS protect against interception
What You're NOT Protected Against Yet
- ❌ Zero-day exploits - Unknown vulnerabilities in software
- ❌ Physical access attacks - Someone with your device can bypass many protections
- ❌ Social engineering - Manipulating you into revealing information
- ❌ Supply chain attacks - Compromised hardware or software from manufacturers
- ❌ Nation-state adversaries - Advanced persistent threats with unlimited resources
⚠️ Know Your Limits
These tools make you significantly more secure, but no system is perfect. If you're facing nation-state adversaries or organized crime, consult professional security experts.
Maintenance Schedule
Weekly
- Review Pi-hole query logs for suspicious domains
- Check GlassWire for new/unknown connections
- Verify VPN is connected and not leaking
Monthly
- Update Pi-hole blocklists
- Review all devices on network, remove unknown ones
- Test hardware security keys on critical accounts
- Capture 5-minute Wireshark session and review for anomalies
Quarterly
- Audit all accounts using hardware keys
- Review and update VPN configuration
- Practice incident response with Wireshark
- Update all security tools and firmware
🎉 You're Now a Power User
You have visibility and control that most people never achieve. Ready for the next level?
Next: Home Fortress → View All Guides