Professional Documents
Culture Documents
Curious MR X - Scenario
Curious MR X - Scenario
Unfortunately for Mr. X, the lab’s network is instrumented to capture all traffic (with full content).
His activities are discovered and analyzed… by you!
Here is the packet capture containing Mr. X’s activity. As the network forensic investigator, your
mission is to answer the following questions:
2. For the FIRST port scan that Mr. X conducted, what type of port scan was it? (Note: the scan
consisted of many thousands of packets.) Pick one:
TCP SYN
TCP ACK
UDP
TCP Connect
TCP XMAS
TCP RST
6. What TCP ports were open on the Windows system? (Please list the decimal numbers from lowest
to highest.)
You don't have to answer this, but you get super bonus points if you do): What was the name of the
tool Mr. X used to port scan? How can you tell? Can you reconstruct the output from the tool,
roughly the way Mr. X would have seen it?