Find the host that is not on your list

short · 50 min · Objective 2.1

Task

Build an inventory three ways -- from your records, from active discovery, from passive observation -- and find the assets each method misses. The gap between them is the number that makes every coverage percentage in this course meaningful or meaningless.

Steps

  1. Write your inventory from memory and records: every VM you believe exists on 10.10.10.0/24, with its address and purpose.
  2. Start a third VM on the lab network. Give it an address. Do not add it to the inventory, and do not install any agent on it.
  3. Active discovery: sweep the subnet from the Linux VM with a ping and port sweep. Record everything that answers.
  4. Passive discovery: capture traffic on the lab network for fifteen minutes while all three VMs do ordinary things. Extract every distinct address seen.
  5. Agent-based inventory: list the hosts your collector has received logs from in the last hour.
  6. Build the three-column comparison. Then answer the question that matters: for each method, what class of asset does it structurally miss?

Verify

nmap -sn 10.10.10.0/24 -oG - | awk '/Up$/{print $2}' | sort > /tmp/active.txt
tshark -r /tmp/discovery.pcap -T fields -e ip.src 2>/dev/null | sort -u > /tmp/passive.txt
ls /var/log/collected/ | sed 's/\.log$//' | sort > /tmp/agents.txt
comm -23 /tmp/active.txt /tmp/agents.txt
wc -l /tmp/active.txt /tmp/passive.txt /tmp/agents.txt

The comm output is the finding: every host that answers on the network and sends no logs. Your third VM must appear there. The three counts must differ, and the agent count being the lowest is the normal and dangerous case -- it is the denominator most coverage metrics quietly use.

Notes

Passive discovery misses anything silent; active discovery misses anything firewalled or transient; agent inventory misses anything without an agent, which is exactly the population you most want to know about.

Keep /tmp/active.txt. It is the independent denominator the scanning, detection-coverage and metrics labs all need -- and the reason those numbers mean anything is that this list was not produced by the tool being measured.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.