Performing Network Reconnaissance using Common Tools

In this lab, you explored the common tools available in the virtual lab environment. You used Wireshark to capture and analyze network traffic, OpenVAS to scan the network, reviewed a sample collection of data using NetWitness Investigator, connected to a remote Windows machine and explored two file transfer applications, FileZilla and Tftpd64. You used PuTTY to connect to a Linux machine and ran several Cisco commands to display statistics for the network interfaces. Finally, you used Zenmap to perform a scan of the network and created a network topology chart.

Lab Assessment Questions & Answers
1. Name at least five applications and tools used in the lab. FileZilla, net witness investigator, Open VAS,PuTTY,Wireshark.

2. What is promiscuous mode?
it allows Wireshark to capture packets to any host on the same supnet or VLAN

3. How does Wireshark differ from NetWitness Investigator? NetWitness allows analysts and view the packets

4. Why is it important to select the student interface in the Wireshark? it runs in a lab setting

5. What is the command line syntax for running an Intense Scan with Zenmap on a target subnet of 172.30.0.

6. Name at least five different scans that may be performed with Zenmap. Intense Scan, Basic Recon,fisheye,pingscan,

Jones & Bartlett Learning, LLC. NOT FOR SALE OR DISTRIBUTION

7. How many different tests (i.e., scripts) did your Intense Scan perform?

8. Based on your interpretation of the Intense Scan, describe the purpose/results of each tests script performed during the report.

9. How many total IP hosts did Zenmap find on the network?