Task 1: IP Address
What is the IP address scanning the environment?
Filtering the capture shows a single source IP sending a disproportionate number of requests across many destination ports and hosts. The signature of an active scan rather than normal traffic.
Scan IP Address
Answer: 10.42.42.253
Task 2: IP Found
What is the IP address found as a result of the scan?
Following the scan traffic, we can see an ICMP echo request/reply pair between the scanner and 10.42.42.50, confirming the host responded and was discovered.
Task 2: IP Found
Answer: 10.42.42.50
Task 2: Finding MAC Address
What is the MAC address of the Apple system it finds?
Inspecting the Ethernet frame headers for 10.42.42.50, the source MAC address resolves to an Apple-registered OUI, identifying the vendor as Apple directly from the frame itself.
MAC Address Identified
Answer: 00:16:cb:92:6e:dc
Task 3: IP Windows PC
What is the IP address of the detected Windows system?
Looking at the SMB traffic in the capture, 10.42.42.25 is seen initiating a connection to an SMB server at 10.42.42.50 SMB being a Windows-native protocol, this identifies 10.42.42.50 as the Windows system.
Identified SMB Traffic
Answer: 10.42.42.50