Reading the wire
A packet capture was pulled from the segment during the incident. Open it with tshark: size it up, identify the host being port-scanned, and find the command-and-control domain a victim looked up.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`tshark -r FILE | wc -l` counts packets.
`-Y 'tcp.flags.syn==1'` isolates the scan; `-Y dns` isolates lookups.
Solution explanation
The wire corroborated the rest: a 16-packet capture showing a TCP SYN sweep against 10.10.10.5 and a DNS lookup for sync-updates-cdn.net, a command-and-control domain. tshark -r with a display filter (-Y) and field output (-T fields -e) turns a binary capture into answers you can act on.
Show solution
cd /home/student
tshark -r /srv/soc-data/network/capture.pcap
tshark -r /srv/soc-data/network/capture.pcap -Y 'tcp.flags.syn==1' -T fields -e ip.dst | sort -u
tshark -r /srv/soc-data/network/capture.pcap -Y dns -T fields -e dns.qry.name