https://app.letsdefend.io/challenge/port-scan-activity/
First download the Log file which contains a pcap file and open it in Wireshark.
Question 1
What is the IP address scanning the environment?
We can see that is 10.42.42.253 sending a TCP 3-way handshake to a couple of different IP addresses. This suggests that that particular IP address is initiating a scan.
Answer: 10.42.42.253
Question 2
What is the IP address found as a result of the scan?
Sort the protocol and look for NBNS.
10.42.42.50 is the only IP address that responds back to the name query.
Answer: 10.42.42.50
Question 3
What is the MAC address of the Apple system it finds?
Head to Statistics –> Conversations –> Ethernet tab and toggle the Name Resolution option at the bottom. We are able to find a Apple system.
Answer: 00:16:cb:92:6e:dc
Question 4
What is the IP address of the detected Windows system?
Head to Statistics –> Endpoint –> IPv4
From what we gather so far:
- 10.42.42.25 – Apple System
- 10.42.42.50 – Windows System
- 10.42.42.56 – Unknown System
- 10.42.42.253 – Attacking System
- 10.255.255.255 – Network Broadcast Address
Answer: 10.42.42.50
Persecure : my learning archive 