Description

Open Wireshark and then download the packet capture (pcap) of an NFS bad delay packet file.. SampleCaptures (wireshark.org)

While a delayed request is good to review from a network perspective, your goal is to review the data to see if you can read the packets.

Validate the hash of the file with SHA-256. It should match the hash below: 46da2b7056381d86672d2825525c1e5aa02e3aba408fdcd372a947d76fa93e5b

Once the hash is validated, open your downloads, right click on the downloaded file nfs_bad_stalls. cap and select Open With and select Wireshark.

Open Wireshark and scroll down to line 20 (Example below):

Open the packet in Wireshark for line 20 and answer the following questions:

What is the source port for this packet in line 20?

What is the destination port?

How does understanding how to read regular packets (such as the one in the module) help you identify attacks when you are working in a role?

Part 2

Please answer the following questions in your own words, using 2-4 sentences each and references: * What is NFS and how does it work? * Research NFS and explain 1-2 ways that someone could exploit/attack by using NFS.