Forum Discussion

bluejacket's avatar
bluejacket
Icon for Bronze II rankBronze II
2 months ago
Solved

Zeek Ep 4 Scripting

Question 10 "After editing the required file, try to execute the script stated in Question 9 again. How many scans of unique ports are made from the IP address 192.168.100.103?" I don't understan...
defensive cyber
immersive labs
  • bluejacket's avatar
    bluejacket
    2 months ago

    Got it! I realized I was looking at the wrong output file after solving the question before.
    The output file from the zeek script will give the number of unique connections.

YasserSalama's avatar
YasserSalama
Icon for Bronze I rankBronze I
2 months ago

Try 🍇

cat conn.log | zeek-cut id.orig_h id.resp_p | awk '$1=="192.168.100.103" {print $2}' | sort -u | wc -l

bluejacket's avatar
bluejacket
Icon for Bronze II rankBronze II
2 months ago

Thanks for your help. It was less about the filter and more about looking through all the other log outputs outside of conn.log