Active reconnaissance, sniffing and protocol scanning

Objective 2.1 in this course covers active and passive reconnaissance — CompTIA describes it as gathering information using open-source intelligence (OSINT), network sniffing and protocol scanning. Lesson 7 took the passive half; this is the active half, where you start leaving traces.

Why this matters

This is the lesson where the engagement becomes visible. Everything in lesson 7 happened without the client knowing; from here, every action you take appears in somebody's log, and may appear on somebody's screen as an alert at two in the morning.

That changes two things. Your work is now inside the testing window and the scope, without exception. And it has impact — scans consume resources, fill logs, and occasionally take fragile things down.

The lesson

The moment you start generating evidence on their side

Crossing from passive to active means you are now a participant in the client's environment, and three obligations start at once:

1. You are inside the window. Lesson 3's testing window exists for this. Activity outside it is unauthorised even if the target is in scope.
2. You are in their telemetry. Their analysts will see your traffic and may respond to it as an incident. Whether they have been told a test is happening is the client's decision, and it is worth knowing which, because an unannounced test that triggers their incident process is a result in itself — but only if everyone understands that is what happened.
3. You are logging too. The timestamped activity log from lesson 3 starts mattering now. When they ask "was the 02:14 spike you?", your log is the only honest answer.

The instinct: before any active action, know that it is in scope, in window, and recorded.

Capturing traffic on a network segment you own

Packet capture is the least intrusive active technique — often entirely passive on the wire — and the most informative about what is actually happening, as opposed to what the documentation claims.

What it gets you early in an engagement:

• What protocols are actually in use, including the legacy ones nobody admits to running.
• Broadcast and multicast chatter, which announces hosts, names and services without anyone asking.
• Cleartext anything. Credentials, session identifiers, internal hostnames.
• The shape of normal, so that later, when you are asked whether something is anomalous, you have a baseline.

Two boundaries. Capture is limited to what reaches your interface — on a switched network that is much less than people expect, which is why the on-path techniques in lesson 23 exist. And capturing traffic containing other people's data has the handling obligations from lesson 4: minimum necessary, protected, deleted on schedule.

In this course the capture happens on your own lab segment from lesson 2.

What protocols leak before you have authenticated to anything

A surprising amount of an environment describes itself to anyone who asks, before any credential is involved. The exam expects you to know which protocols are generous:

• Name resolution fallbacks broadcast requests across the local segment, and answering them is the basis of a whole family of attacks.
• Service discovery protocols announce devices, names and capabilities by design.
• Banner-bearing services state their software and version on connection.
• Network management protocols with default community strings expose inventory to a single unauthenticated query.
• Directory services frequently permit anonymous binds that enumerate users.
• Mail and file protocols often confirm whether a username exists, through timing or error differences — which is enumeration even when it is not called that.

The pattern worth carrying: anything that answers a stranger truthfully is reconnaissance surface.

Rate, timing and the scan that takes a service down

Active reconnaissance has a real availability risk, and an exam scenario about a service failing mid-test is asking whether you understand it.

What causes damage:

• Connection exhaustion. Fast scans open many connections; devices with small tables — embedded systems, industrial controllers, old printers — fall over.
• Fragile stacks. Some devices crash on unusual packets. Operational technology and medical equipment are the classic cases, and are usually excluded from scanning for exactly this reason.
• Log flooding, which fills disks and can take down the logging platform the defenders need.
• Automated defences, where your scan trips a block that also affects legitimate users.

Mitigations: slower timing, narrower target sets, scanning in agreed windows, and knowing which asset classes are excluded before you start. And when something does break, say so immediately — the escalation path from lesson 5 runs in this direction too.

Keeping an activity log the client can reconcile with their alerts

The log is a professional obligation and it is also self-protection.

For each action: timestamp with timezone, source address you worked from, the target, the exact command or tool invocation, and a one-line purpose. Written as you go, not reconstructed afterwards.

It gets used in three ways:

• Deconfliction. The client can separate your traffic from a real attacker's — and if a real attacker is present during your test, this log is what makes that distinguishable at all.
• Reproduction. Your report's findings need the command that produced them.
• Defence. If something broke, the log establishes what you did and when.

The failure to avoid: a log written at the end of the day from memory. It will be wrong about times, and times are the entire point.

What to take into the exam

• Active means in-scope, in-window, and logged — every time.
• Capture sees only what reaches the interface; a switch is why on-path techniques exist.
• Know which protocols answer strangers truthfully: name resolution fallbacks, service discovery, banners, management protocols, anonymous directory binds.
• Scanning can cause outages; fragile and operational systems are usually excluded for that reason, and breakage is escalated immediately.
• The activity log is timestamped as you go, and is what lets a client tell you apart from a real intruder.