Triage the incident capture
This is the real thing. The capture at /home/student/case/capture.pcap holds a whole little incident. Work the four questions and pull out the facts:
- who scanned the machine, and how many ports,
- the suspicious domain the victim phoned home to, and
- the password that leaked in the clear.
Then write a short summary.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Scan: filter SYN-only, read `ip.src`, count unique `tcp.dstport`.
Domain: `tshark -Y dns -e dns.qry.name`. Password: `tcpdump -A` then grep `password=`.
Put BOTH the scanner IP and the domain into /home/student/summary.txt.
Solution explanation
You ran a full triage from one capture. The four questions gave you the whole story: 203.0.113.66 scanned 8 ports on the victim, the victim then phoned home to sync-update-cdn.net, and a login leaked the password SpringTime2026 over plain HTTP. Written up, those facts let the team block the attacker and the domain and reset the password — which is exactly what network traffic analysis is for.
Show solution
tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src -e tcp.dstport 2>/dev/null
tshark -r /home/student/case/capture.pcap -Y dns -T fields -e dns.qry.name 2>/dev/null | sort -u
tcpdump -nAr /home/student/case/capture.pcap 2>/dev/null | tr -d '\r' | grep 'password='
echo 'scanner 203.0.113.66 hit 8 ports; victim phoned home to sync-update-cdn.net; password SpringTime2026 leaked' > /home/student/summary.txt