Homework 2

Due Date: 2026-04-27 23:59:59

Homework 2

Introduction

tcpdump is a packet capture utility that we will be using extensively throughout the rest of this course. Let’s get some practice using it! You’ve done a couple of practice exercises, let’s put them to use!

tcpdump (and wireshark and tshark) use BSD packet filter (BPF) style filters. Let’s work a bit with them!

What you must do

nmap

Before starting the nmap tasks, review the Reconnaissance page — it explains what each scan type (-sT, -sS, -sU, -sV, -O, -A) actually does and what you should expect to see in the output.
1. Simple scans against scanme.nmap.org (nmap’s official test target — scanning it is explicitly permitted):
  
  Take a look at the nmap man page (man nmap), and then perform the following scans:
  - a TCP connect scan (-sT) of ports 20-100, 130-150, and 400-500
  - a UDP scan of the top 100 ports
  - an OS detection scan with aggressive guessing
  - an IP protocol scan (-sO)
2. Try at least 2 output formats. Save results with -oA scanme_results. Personally, I find the -oS output amusing.
3. Local network host discovery:
  1. Run an ARP ping sweep of your VM’s subnet (-sn -PR). How many hosts respond? What MAC vendor prefixes do you see?
  2. Compare the ARP results to an ICMP sweep (-sn -PE). Any differences? Why might hosts appear in one but not the other?
  3. Save the live host list to a file and use it as input (-iL) for all subsequent scans.
4. Port scanning your local subnet (use your live hosts file from above):
  1. Run a SYN scan (-sS) of the top 1000 ports. What services are visible?
  2. Run a UDP scan (-sU) of the top 100 ports. Compare to TCP — what’s different?
  3. Try the TARGET SPECIFICATION options from the manpage:
    - combine CIDR notation with --exclude
    - try a different timing template and note the time difference
5. Service and OS detection:
  1. Run -sV against your live hosts. What service banners do you get?
  2. Run -O --osscan-guess. How accurate is nmap’s OS detection against your VMs?
  3. Run -A (the “kitchen sink” flag) and compare the output to the individual flags above.
6. NSE scripts:
  1. Run --script="default" (or equivalently -sC) against your live hosts. What additional information appears?
  2. If any hosts have ports 139 or 445 open, run the SMB scripts (smb-os-discovery, smb-enum-shares).
  3. If any hosts have port 80 or 443 open, run http-title and ssl-cert.
7. Full local recon workflow: Follow the workflow in the Practical Local Recon Workflow section above against your VM subnet. Save all output with -oA. My subnet took about 3 minutes end-to-end with -T4 — YMMV.
tcpdump

The captures below require shell pipes (cmd1 | cmd2), output redirection (cmd > file), and basic awk (awk '{print $2}'). If any of those are unfamiliar, skim the Linux page before continuing.
1. Perform a tcpdump capture where you only capture DNS packets.
2. Perform a tcpdump capture where you capture TCP packets that are destined for either port 443 or 8080, and originate from your computer.
3. Perform a tcpdump capture where traffic is either UDP or TCP, is inbound to your computer, and destined for a port between 20000 and 35000.
In all cases, determining how to generate the traffic you need is part of the assignment. All of these dumps are not likely to pick up traffic from your VM without you intervening!

All dumps should have full data dumps without link layer headers, in hex and ascii, with Unix epoch style timestamps. Something like this:
```
  1585339575.038549 IP (tos 0x0, ttl 64, id 37629, offset 0, flags [DF], proto UDP (17), length 60)
      kali478-0.38378 > _gateway.domain: [bad udp cksum 0x6ede -> 0x96ae!] 54659+ A? www.google.com. (32)
  	0x0000:  4500 003c 92fd 4000 4011 390f ac10 8b81  E..<..@.@.9.....
  	0x0010:  ac10 8b02 95ea 0035 0028 6ede d583 0100  .......5.(n.....
  	0x0020:  0001 0000 0000 0000 0377 7777 0667 6f6f  .........www.goo
  	0x0030:  676c 6503 636f 6d00 0001 0001            gle.com.....
```
Captures can be included in your markdown file by enclosing them in triple backticks, like so:
```
  ```
  1585339575.038549 IP (tos 0x0, ttl 64, id 37629, offset 0, flags [DF], proto UDP (17), length 60)
      kali478-0.38378 > _gateway.domain: [bad udp cksum 0x6ede -> 0x96ae!] 54659+ A? www.google.com. (32)
  	0x0000:  4500 003c 92fd 4000 4011 390f ac10 8b81  E..<..@.@.9.....
  	0x0010:  ac10 8b02 95ea 0035 0028 6ede d583 0100  .......5.(n.....
  	0x0020:  0001 0000 0000 0000 0377 7777 0667 6f6f  .........www.goo
  	0x0030:  676c 6503 636f 6d00 0001 0001            gle.com.....
  ```
```
A minimum of 10 packets, as requested, should be included for each capture. You can use the -c flag to limit the number of packets captured.

You might notice that all the packets you capture either originate or terminate at your computer. There’s a reason for this, and we’ll go over it in class, as well as some ways to get around it.

Submission

Once you have completed the above, you should have a markdown file in your repo called hw2/hw2.md that contains all the requested information. Commit and push this to your repo. Also commit and include the requested screenshots. Once you have done this, you can consider the assignment submitted.