Map a lab segment and reconcile it with your own log

applied · 80 min · Objective 2.1

Task

Actively map your own lab segment, keep a timestamped activity log as you go, then reconcile the two — proving that a client could tell your traffic apart from a real intruder's. Objective 2.1 is reconnaissance, and the activity log is what makes active work defensible.

Steps

  1. On the lab network you own, run active discovery from the attacker VM: host discovery, then service and version detection against what answers. Keep the rate gentle.
  2. As you go, append to /tmp/activity.log one line per action: <ISO timestamp>\t<source>\t<target>\t<command>\t<purpose>.
  3. Separately, capture traffic during the run to /tmp/active.pcap.
  4. Reconcile: extract the times and targets your capture shows against the times and targets your log claims. They should line up.
  5. Identify one asset class your active sweep structurally misses — anything firewalled, transient, or switched off — and note it, because absence of a reply is not absence of a host.
  6. Note which of your probes carried an availability risk and why you chose the rate you did.

Verify

awk -F'\t' 'NF>=5{c++} END{print c" well-formed log line(s)"}' /tmp/activity.log
grep -cE "T[0-9]{2}:[0-9]{2}" /tmp/activity.log
tshark -r /tmp/active.pcap -T fields -e ip.dst 2>/dev/null | sort -u | wc -l

The first count must be at least 3 — enough actions to reconcile, each with all five fields. The second confirms the timestamps are real ISO times, not "morning ish": the whole value of the log is that it answers "was the 02:14 spike you?" to the minute. The third must be non-zero and should correspond to the targets in the log — the reconciliation is the point.

Notes

If a real attacker were present during your test, this log is the only thing that makes your activity distinguishable from theirs — which is why it is written as you go, not reconstructed from memory at the end of the day, when it will be wrong about exactly the times that matter. On an engagement the same log deconflicts your traffic with the client's SOC.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.