$1$ Configure the network adapters of SIFT and Windows to the same NAT Network to ensure both machines can communicate.

$2$ Start the SSH service on the SIFT machine by using sudo service ssh start

sansforensics@siftworkstation: $ sudo service ssh start sansforensics@siftworkstation:

$3$ Drop the provided zeek$-$installer.sh and investigate$\_$me$.$pcap files to Windows $10$ and transfer the files to SIFT. To transfer the files, use $"$C:$\backslash$Program

Files$\backslash$PuTTY$\backslash$pscp$.$exe" $-$P $22[$filename$]$

sansforensics@$[$IPaddress$]$:$/$home$/$sansforensics$/$Desktop

Note: You can transfer one file at a time or both. If PuTTY isn't installed, use the Putty$-64$bit$-0\mathrm{.}74-$installer.

C:$\backslash$Users$\backslash$Dave$\backslash$Desktop$>"$C:$\backslash$Program Files$\backslash$PuTTY$\backslash$pscp$.$exe" $-$P $22$ investigate$\_$me$.$pcap zeek$-$installer.sh sansforensics@$18\mathrm{.}8\mathrm{.}214$:$/$home$/$sansforensics$/$Desktop The server's host key is not cached in the registry. You

have no guarantee that the server is the computer you

think it is$.$

The server's ssh$-$ed$25519$ key fingerprint is:

ssh$-$ed$255192554$a:$98$:$6$e:$20$:$27$:$80$:$8$c:$52$:ef:$6$c:$3$f:$9$f:c$3$:de:$14$:fa

If you trust this host, enter $"$y$"$ to add the key to

PuTTY's cache and carry on connecting.

If you want to carry on connecting just once, without

adding the key to the cache, enter $"$n$".$

If you do not trust this host, press Return to abandon the

connection.