Read the handshake
The capture at /home/student/case/capture.pcap holds one short connection. Work out who connected to whom, and on which port.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Filter the SYN with `tcp.flags.syn==1 && tcp.flags.ack==0` and read its `ip.src`.
The `tcp.dstport` on that packet is the service port.
Solution explanation
The first SYN came from 10.10.10.5, so the client started the conversation, and its destination port was 80 — plain, unencrypted web. Reading the handshake is how you answer “who called whom, and what service did they want?” without seeing a single byte of the actual data.
Show solution
tshark -r /home/student/case/capture.pcap -T fields -e ip.src -e ip.dst -e tcp.flags.str 2>/dev/null
tshark -r /home/student/case/capture.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src -e tcp.dstport 2>/dev/null
echo 'connected to port 80' > /home/student/findings.txt