This scenario is based on the email harassment at Nitroba State University. This case is a hypothetical

cased used for training and competency assessment purposes. There are two parts of this scenario:

$1.$ Complete the lab.

a$.$ Identify whether the harassment email was sent by one of the students in the class.

i$.$ Map out the Nitroba dorm room network.

ii$.$ Find out who sent email to lilytuckrige@yahoo.com.

iii. Identify the other TCP connections that belong to the attacker.

iv$.$ Find information in one of those TCP connections that IDs the attacker.

b$.$ Complete your technical analysis to discover the email$$s sender$.$ Drop down notes and

record any data files.

$2.$ In Part $1,$ you identified the sender of the email and they have been spoken to and subsequently

suspended from the University. They are appealing the suspension and since Nitroba is a stateowned University, the appeal is being heard in the NSW Civil and Administrative Tribunal

$($NCAT$).$ The conclude has now instructed you to:

a$.$ Prepare an expert$$s report detailing the analysis$/$examinations that led you to conclude

that XXX was the sender of the email.

b$.$ Demonstrate the reliability of you conclusion by showing an alternate solution or using

alternate tools to arrive at the same result $$ you might also find you arrived at the

wrong conclusion first time around;

c$.$ In doing the above, you are to assume that the NITROBA.PCAP file provided to you by

the IT Department was reliable up to the time that it was provided to you.