Unit 8: Scans, beacons and leaks · Lesson 1 of 6 · 20 min
Spotting a port scan
Use TCP flags to find a scanner and the ports that answered it.
mission
- You are
- The analyst on the morning shift.
- Situation
- The perimeter alerting fired overnight for web01. The capture of the alert window is scan.pcap.
- Goal
- Identify the scanner, measure the scan and list which ports answered.
- Hand in
- The scanner's address, the ports probed and the ports found open.
Ports as doors
Size the capture
Most of these packets will be the scan itself.
tshark -r scan.pcap | wc -l
240
Find who sends the SYNs
A SYN scan sends connection requests and never finishes them. Rank the senders of SYNs without ACK.
tshark -r scan.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==0' -T fields -e ip.src | sort | uniq -c | sort -rn
100 203.0.113.50
4 10.10.0.23
2 10.10.0.31
you should see One outside address sent 100 SYNs. The laptops opened six normal connections.
List the ports that said yes
SYN-ACKs back to the scanner are the ports that are open to the internet.
tshark -r scan.pcap -Y 'tcp.flags.syn==1 && tcp.flags.ack==1 && ip.dst==203.0.113.50' -T fields -e tcp.srcport | sort -n
22
80
443
8443
you should see Four open ports. 80 and 443 are expected. 22 and 8443 are not, from the internet.
defender tip Every public server is scanned all day. The scan is not the incident; an open port nobody can explain is.
Filters for this lesson
| Command | What it does |
|---|---|
tcp.flags.syn==1 && tcp.flags.ack==0 | Connection attempts only |
tcp.flags.syn==1 && tcp.flags.ack==1 | SYN-ACK replies: a port said yes |
tcp.flags.reset==1 | Resets: refused or abandoned connections |
sort | uniq -c | sort -rn | Rank the values tshark prints |
sort -u | wc -l | Count distinct values |
Read the scanner's TTL
A single, steady TTL means every packet came from one machine the same distance away.
tshark -r scan.pcap -Y 'ip.src==203.0.113.50' -T fields -e ip.ttl | sort | uniq -c
104 47
you should see Every packet arrives with TTL 47.
What a defender takes away
- 1Many SYNs from one source to many ports, with no data, is a scan.
- 2SYN-ACKs to the scanner are your real exposure list.
- 3Close what nobody can explain, then restrict what must stay open.
Questions
0 of 4 solved
Answer each one from what you find on your lab machine.