Find the scanner
An alert says a machine was being scanned. The capture at /home/student/case/capture.pcap holds the traffic.
Find the address doing the scanning, and count how many different ports it tried.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Filter to SYN-only packets: `tcp.flags.syn==1 && tcp.flags.ack==0`.
The shared `ip.src` is the scanner; count the unique `tcp.dstport` values for the width.
Solution explanation
The capture had the classic scan fingerprint: a single source, 203.0.113.66, firing SYN packets at 12 different ports on the target. Counting the unique destination ports measured how wide the scan was, and the shared source address named the scanner. That is usually the earliest sign of an attack — someone checking which doors are open before trying to walk through one.
Show solution
tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src -e tcp.dstport 2>/dev/null
tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e tcp.dstport 2>/dev/null | sort -n | uniq | wc -l
echo 'scanner: 203.0.113.66' > /home/student/findings.txt