SYN Scan in a PCAP: Find the Scanner and Open Ports
The firewall team saw a burst of inbound connection attempts to the server subnet overnight and mirrored the subnet’s switch port for a few seconds while it was happening. They want to know who was knocking, what kind of scan it was, and what the scanner learned.
The servers live in 10.20.50.0/24 behind a gateway at 10.20.50.1. Users sit in 10.20.30.0/24. Everything in this file is synthetic: documentation IP ranges, .example names and random bytes where encryption would be.
What you will find in the capture
- Background noise: ARP, DNS lookups and an ordinary HTTPS session from a user
- A burst of connection attempts from one internet address to several servers
- A mix of refused ports and a few that answered
SYN Scan in a PCAP: Find the Scanner and Open Ports
The firewall team saw a burst of inbound connection attempts to the server subnet overnight and mirrored the subnet’s switch port for a few seconds while it was happening. They want to know who was knocking, what kind of scan it was, and what the scanner learned.
The servers live in 10.20.50.0/24 behind a gateway at 10.20.50.1. Users sit in 10.20.30.0/24. Everything in this file is synthetic: documentation IP ranges, .example names and random bytes where encryption would be.
You will practise
- Recognise a port scan from the shape of the TCP handshakes
- Tell a half-open (SYN) scan from a full connect scan
- Use TCP flag filters to show only the ports that answered open
- Measure how long a scan took and how many probes it sent
- Decide what to do about exposed services after a scan
8 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
18.4 kB · 207 packets · SHA-256 7a6a6a9fd2e289ac47075cb5bb5b9e0bc96d86fbda82dcc5f36fd9b5a7e40d20
Sample of the debrief
This capture shows a fast TCP SYN scan from a single internet address against four servers. Closed ports answer with RST/ACK, open ports answer with SYN/ACK, and the scanner resets each open one without completing the handshake: it is mapping services, not using them.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Recognise a port scan from the shape of the TCP handshakes
- Tell a half-open (SYN) scan from a full connect scan
- Use TCP flag filters to show only the ports that answered open
- Measure how long a scan took and how many probes it sent
- Decide what to do about exposed services after a scan
Frequently asked questions
How do you detect a port scan in Wireshark?
Filter for connection openings with tcp.flags.syn == 1 && tcp.flags.ack == 0. A scan shows one source sending SYNs to many ports or hosts within seconds, most answered by RST/ACK. Statistics > Conversations makes the one-to-many pattern obvious.
What is the Wireshark filter for open ports in a SYN scan?
tcp.flags.syn == 1 && tcp.flags.ack == 1 shows SYN/ACK replies, which mean a port is listening. Add ip.dst == <scanner> so normal connections in the same capture do not appear.
What is the difference between a SYN scan and a connect scan?
A SYN (half-open) scan answers a SYN/ACK with a RST and never completes the handshake. A connect scan completes the three-way handshake with an ACK, then closes the connection. Both reveal the same open ports.
What does RST/ACK mean in a scan?
The target host is up but nothing listens on that port, so it refuses the connection. No answer at all usually means a firewall dropped the probe.
Is this real traffic?
No. PlayCISO generated it with its own script from a fixed seed: documentation IP ranges (RFC 5737), private RFC 1918 addresses, .example names, locally administered MAC addresses and random bytes in place of encryption.