Reading a port scan from the defender side
A capture from a server segment shows a burst of connection attempts. Identify the scanner, count the ports it tried, and list the ports that answered as open.
Briefing
The IDS raised a port scan alert for 10.0.5.10, a file server. The capture is at /cases/scan.pcap.
A SYN scan sends one SYN per port. An open port answers with SYN, ACK. A closed port answers with RST, ACK. The scanner then resets the open ones without finishing the handshake.
sensor-02 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.