Open your first capture
A capture file is waiting at /home/student/case/capture.pcap. Open it, count how many packets it holds, and work out which address sent the most packets.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Open it with `tcpdump -nr /home/student/case/capture.pcap`.
Count packets by piping into `wc -l`; find the busiest sender by counting `ip.src`.
Solution explanation
You opened a real capture and answered the two opening questions: it holds six packets, and 10.10.10.5 (the client) sent the most. That is always step one — get a feel for the size of the capture and who the main talkers are before you dig into what they said.
Show solution
tcpdump -nr /home/student/case/capture.pcap
tcpdump -nr /home/student/case/capture.pcap | wc -l
tshark -r /home/student/case/capture.pcap -T fields -e ip.src 2>/dev/null | sort | uniq -c | sort -rn