Lab 2: Network Traffic Analysis
Scenario Context
An attacker used SYN flooding to disrupt the network and bypass the firewall. The SOC team captured network traffic and provided a file for analysis. Analyze the capture and determine the source IP address of the attack.
Packet Analysis Workspace
| No | Source IP | Destination IP | Protocol | Info |
|---|---|---|---|---|
| 1 | 20.20.10.19 | 20.20.10.26 | TCP | SYN |
| 2 | 20.20.10.19 | 20.20.10.26 | TCP | SYN |
| 3 | 20.20.10.60 | 20.20.10.26 | TCP | ACK |
| 4 | 20.20.10.19 | 20.20.10.26 | TCP | SYN |
| 5 | 20.20.10.180 | 20.20.10.26 | TCP | ACK |
Top SYN Source detected: 20.20.10.19
Assessment Question
Which IP address is responsible for the SYN flood attack?
✅ Correct! The attacker IP is 20.20.10.19.
This IP repeatedly sends SYN packets, indicating a SYN flood attack.
❌ Incorrect.
Learning hint: Look for repeated SYN packets from a single source without completing the handshake.
Hint: Focus on repeated SYN packets in the capture.
Explanation:
A SYN flood attack is identified by repeated SYN packets from one source. In this capture, 20.20.10.19 is the most frequent SYN sender, making it the attacker.
A SYN flood attack is identified by repeated SYN packets from one source. In this capture, 20.20.10.19 is the most frequent SYN sender, making it the attacker.