The DMZ victim – 10.30.30.20 (aka 172.30.1.213) First noticeable difference in SSH connection from 172.30.1.77 to 10.30.30.20.
{"Image DocumentName": "The DMZ victim \u2013 (aka )First noticeable difference in SSH connection from to", "Image ImageDescription": ":01:08 (in the Argus flow record data) Size of data is a lot bigger than previous attempts, indicating a successful connection. Over a minute later we see a different connection, indicates a manual connection. Now /80 is communicating to external /80. Notice that at 13:03:31 it begins to send TCP SYN to internal systems on port 80 and 443 and at 13:03:44 the IP dst addresses become sequential and incremental. Port sweep. Also notice that most systems did not respond.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}