Packet (.pcap) files: https://drive.google.com/drive/folders/1-Zx34tyQ5bEZwMZn_t4LB8jOiXgDyowK?usp=sharing 

 

Open these .pcap files through Wireshark to access the data needed to correctly resolve this prompt. Please include screenshots of where the information is found throughout Wireshark.

 

Packet Capture 1: File1.pcap: 

• What are the sources of the traffic that you have identified in the capture (IP Addresses, MAC Addresses)?
• What are the destinations of the traffic you have identified in the capture (IP Addresses, MAC Addresses)?
• What was the timeframe in which the malicious network activity took place?
• What type of traffic are you able to identify in the capture? Explain how you know this.
• What is the purpose of the traffic you identified in the capture? Explain how you know this.
• Is the traffic safe/normal or suspicious/malicious?
  • What makes you arrive at this conclusion? Be specific.
• If this is malicious, what are the IP Addresses of the attacker and victim?
• If there is an attack, what could be done in the future to protect against similar attacks to the network system?
• What did you learn in your process of determining the signature of this packet capture?

 

Packet Capture 2: File2.pcap: 

• What are the sources of the traffic that you have identified in the capture (IP Addresses, MAC Addresses)?
   
• What are the destinations of the traffic you have identified in the capture (IP Addresses, MAC Addresses)?
   
• What was the timeframe in which the incident took place?
• What type of traffic are you able to identify in the capture? Explain how you know this.
• What is the purpose of the traffic you identified in the capture? Explain how you know this.
• Is the traffic safe/normal or suspicious/malicious?
  • What makes you arrive at this conclusion? Be specific.
• If this is malicious, what are the IP Addresses of the attacker and victim?
• If there is an attack, what could be done in the future to protect against similar attacks to the network system?
• What did you learn in your process of determining the signature of this packet capture?

 

• Packet Capture 3: File3.pcap:
  • What are the sources of the traffic that you have identified in the capture (IP Addresses, MAC Addresses)?
• What are the destinations of the traffic you have identified in the capture (IP Addresses, MAC Addresses)?
• What was the timeframe in which the incident took place?
• What type of traffic are you able to identify in the capture? Explain how you know this.
• What is the purpose of the traffic you identified in the capture? Explain how you know this.
• Is the traffic safe/normal or suspicious/malicious?
  • What makes you arrive at this conclusion? Be specific.
• If this is malicious, what are the IP Addresses of the attacker and victim?
• If there is an attack, what could be done in the future to protect against similar attacks to the network system?
• What did you learn in your process of determining the signature of this packet capture?

 

 

• Packet Capture 4: File4.pcap:
  • What are the sources of the traffic that you have identified in the capture (IP Addresses, MAC Addresses)?
• What are the destinations of the traffic you have identified in the capture (IP Addresses, MAC Addresses)?
• What was the timeframe in which the incident took place?
• What type of traffic are you able to identify in the capture? Explain how you know this.
• What is the purpose of the traffic you identified in the capture? Explain how you know this.
• Is the traffic safe/normal or suspicious/malicious?
  • What makes you arrive at this conclusion? Be specific.
• If this is malicious, what are the IP Addresses of the attacker and victim?
• If there is an attack, what could be done in the future to protect against similar attacks to the network system?
• What did you learn in your process of determining the signature of this packet capture?

 

• Packet Capture 5: File5.pcap:
  • What are the sources of the traffic that you have identified in the capture (IP Addresses, MAC Addresses)?
• What are the destinations of the traffic you have identified in the capture (IP Addresses, MAC Addresses)?
• What was the timeframe in which the incident took place?
• What type of traffic are you able to identify in the capture? Explain how you know this.
• What is the purpose of the traffic you identified in the capture? Explain how you know this.
• Is the traffic safe/normal or suspicious/malicious?
  • What makes you arrive at this conclusion? Be specific.
• If this is malicious, what are the IP Addresses of the attacker and victim?
• If there is an attack, what could be done in the future to protect against similar attacks to the network system?
• What did you learn in your process of determining the signature of this packet capture?