https://xss3cut10n3r.com/tags/network-forensics/Recent content in Network Forensics on XSS3cut10n3rHugoen-USSat, 03 Oct 2026 00:02:00 +0100https://xss3cut10n3r.com/posts/nsa-codebreaker-2025-task-2/Sat, 03 Oct 2026 00:02:00 +0100https://xss3cut10n3r.com/posts/nsa-codebreaker-2025-task-2/<p><a href="https://xss3cut10n3r.com/posts/nsa-codebreaker-2025/">← Series overview</a></p> <h2 id="task-2---the-hunt-continues---network-forensics">Task 2 - The Hunt Continues - (Network Forensics)</h2> <blockquote> <p>With your help, the team concludes that there was clearly a sophisticated piece of malware installed on that endpoint that was generating some network traffic. Fortunately, DAFIN-SOC also has an IDS which retained the recent network traffic in this segment.</p> </blockquote> <blockquote> <p>DAFIN-SOC has provided a PCAP to analyze. Thoroughly evaluate the PCAP to identify potential malicious activity.</p> </blockquote> <hr> <h2 id="downloads">Downloads</h2> <ul> <li><strong>PCAP to analyze:</strong> <code>traffic.pcap</code></li> </ul> <hr> <h2 id="task">Task</h2> <ul> <li><strong>Submit all the IP addresses that are assigned to the malicious device, one per line.</strong></li> </ul> <hr> <h2 id="writeup">Writeup</h2> <p>Upon opening the PCAP in Wireshark, I was greeted by approximately 2,400 packets consisting primarily of IPv4 and ARP traffic.</p>