Master network forensics identification. This scenario tests your ability to categorize active reconnaissance techniques used during the initial stages of a digital forensic network investigation.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are a network forensic examiner investigating a suspected intrusion within a corporate DMZ. The Intrusion Detection System (IDS) alerted on anomalous traffic originating from a compromised web server targeting an internal database server.

You have extracted the relevant packet capture (PCAP) from the network forensic appliance. Your goal is to analyze the traffic patterns to determine the adversary's methodology and identify what information they were attempting to gather prior to lateral movement.

Evidence Collected

[+] IDS ALERT LOG (Suricata) Timestamp: 2026-04-09 08:14:22 UTC Alert: ET SCAN Potential TCP Scan Source: 10.0.50.22 (Compromised Web Server) Destination: 10.0.60.15 (Target DB Server) [+] PCAP EXTRACT (TCP STREAM SUMMARY) 10.0.50.22:45992 -> 10.0.60.15:21 [SYN] 10.0.60.15:21 -> 10.0.50.22:45992 [RST, ACK] (Closed) 10.0.50.22:45992 -> 10.0.60.15:22 [SYN] 10.0.60.15:22 -> 10.0.50.22:45992 [SYN, ACK] (Open) 10.0.50.22:45992 -> 10.0.60.15:1433 [SYN] 10.0.60.15:1433 -> 10.0.50.22:45992 [SYN, ACK] (Open) [+] EXAMINER NOTES - Adversary is actively probing the target. - Objective: Map available services (SSH, MSSQL) on the target host prior to exploitation.

Question

During a network-forensics investigation, an analyst is using a tool to identify the services and open ports on a remote host. What is this technique commonly called?

Forensic Hint: The adversary is methodically checking "doors" (network sockets) sequentially to see which ones respond with a SYN/ACK, indicating a listening service.

Expert Analysis

1. What the Evidence Shows

The PCAP extract displays sequential TCP SYN packets sent from the compromised server to various ports (21, 22, 1433) on the target database server. The target responds with `RST, ACK` for closed ports and `SYN, ACK` for open ports. This is a classic signature of active network reconnaissance.

2. Forensic Stage

Identification & Analysis - The investigator is analyzing network artifacts to identify attacker methodology and map the timeline of a security breach.

3. Why the Correct Answer is Correct (A)

Port scanning is the specific active technique used to identify open ports and running services on a remote host. The evidence clearly shows a TCP SYN scan (half-open scan), which maps the attack surface of the target host by determining which services are listening for incoming connections.

4. Why Others Are Wrong

B. OS fingerprinting: This involves analyzing TCP/IP stack quirks (like TTL or Window Size) to determine the operating system, rather than just mapping open ports.
C. Packet sniffing: This is the passive interception and logging of network traffic (what the investigator is doing to capture the PCAP), not the active probing performed by the attacker.
D. Vulnerability assessment: This involves checking systems for known CVEs or misconfigurations. While it often includes port scanning as a first step, it is a broader, distinct process.

5. Real-World Forensic Action

Network forensic analysts use tools like Wireshark, Zeek, or Suricata to parse PCAP files and identify these scan patterns. When a port scan is detected in historical traffic, the analyst documents the targeted ports to understand the attacker's intent. For example, if port 1433 (MSSQL) is targeted and found open, the next forensic step is to correlate this network evidence with the host-based SQL Server logs on `10.0.60.15` to look for subsequent brute-force attacks or exploitation attempts.

6. MINI LESSON: Active Reconnaissance vs. Passive Collection

A port scan is an active reconnaissance technique that generates traffic and leaves distinct artifacts in firewall logs, IDS alerts, and packet captures. Passive collection (sniffing) leaves no trace on the target. Recognizing port scan signatures (like sequential SYN packets or abnormal ICMP queries) is crucial for building the attack timeline and isolating the exact moment an adversary pivoted within the network.

Ready to handle more complex forensic scenarios?

Sharpen your digital investigation skills with more practical simulations.

Explore more CHFI simulations