Network Forensics Puzzle Contest

Your Name (required)
 

Your Email (required)
 

1. What was the IP address of Mr. X’s scanner?
 

2. For the FIRST port scan that Mr. X conducted, what type of port scan was it? (Note: the scan consisted of thousands of packets.) TCP SYN TCP ACK UDP TCP CONNECT TCP XMAS TCP RST

3. What are the IP addresses of the targets Mr. X discovered?

4. What is the MAC address of the Apple system he found?
 

5. What is the IP address of the Windows system he found?
 

6. What TCP ports are open on the Windows system? (Please list the
decimal numbers from lowest to highest.)

X-TRA CREDIT (You don’t have to answer this, but you get super bonus points if you do): What was the name of the tool Mr. X used to port scan? How can you tell? Can you reconstruct the output from the tool, roughly the way Mr. X would have seen it?

Solution Description

Additional Text (feel free to paste code here)

By submitting this form, you agree to the following: Exceptional solutions may be incorporated into the SANS Network Forensics Toolkit. Authors agree that their code submissions will be freely published under the GPL license, in order to further the state of network forensics knowledge. Exceptional submissions may also be used as examples and tools in the Network Forensics class. All authors will receive full credit for their work.