ONLY FOR MAESTRO: Assessing Information System Vulnerabilities and Risk
PiggiePoo0206
Project3WIRESHARKLAB.docx• What are the unique pairs of IP addresses that are communicating with one another, based on the Source and Destination addresses in the top frame of Wireshark user interface?
192.168.1.101, 178.123.13.120, 208.117.231.17 are three examples of the IP address transferring information back and forth between each other during this scan
• For each unique pair of IP addresses communicating, what protocols are being used as indicated by Wireshark?
TELNET, TCP, OSPF, MySQL, HTTP, UDP, SSL. These are all the different protocols used to communicate between the source and destination.
• What source and destination port numbers are indicated as being used?
Note: Click on a packet line in the top pane and open the Transmission Control Protocol (TCP) in the middle pane to identify the port numbers (Src Port and Dst Port) for each unique pair of IP addresses communicating with each unique protocol being used (such as TCP or HTTP, and so forth).
SRC Port : 443 to DST Port : 56562
• What are the MAC Addresses for each of the unique pair of machines that are communicating with one another? Note: This can be seen in the middle frame of the Wireshark user interface on the line that is for the Ethernet II layer.
MAC (00:14:0b:33:33:27) (d0:7a:b5:96:cd:0a)
• What plaintext information (if any) can you find in any of the packets in the upper frame of the Wireshark user interface? Note: Check the Packet Bytes pane, located at the bottom, which displays the raw data of the selected packet in a hexadecimal view. ..33’.z……E.
• Refer to Wireshark user’s guide as needed. https://www.wireshark.org/download/docs/user- guide-us.pdf
NMAP
- What can you say about the results?
The results offered more details than was expected, but delivers it in a simple GUI that makes the information easier to comprehend than Wireshark.
- How many ports are reported by scan?
One thousand ports was the average number reported, with majority of them being closed during the scan.
- How many ports are opened?
On average the usual number of open ports were about 14, also the scan detailed the port number and protocol.
- What can you say about the host details in the screenshot above?
The network connection to the host is currently up; there are fourteen ports actively being listened too. The IP and the MAC address are listed, the host is using Internet protocol version 4 and the hostnames in use. Even the operating system were detailed in the scan results.
- Comment on the data of interests in your findings
The data most interesting was seeing the port numbers shown, not only did the scan reveal the number of open ports but also their address number.
