0:00–0:20
Written
0:20–1:45
Practical
1:45–2:00
Review
0:00 – 0:20Written · 20 min
Short-answer and identification, closed-book
- tcpdump flag identification and BPF filter construction; the capture-filter-vs-display-filter distinction.
- Mausezahn syntax — reading a given
mz command and stating what packet it produces, including a spoofed-source example.
- IPTables / NFTables / UFW rule interpretation, and explaining DROP vs. REJECT.
- NTP stratum hierarchy and reading an
ntpq -p output line by column.
- Syslog facility/severity table and rsyslog/logrotate directive meanings.
Instructor note: collect written papers at 0:20 sharp before releasing the practical scenario — the practical builds on nothing from the written half, so there's no reason to let them run long into lab time.
0:20 – 1:45Practical · 85 min
Implement, diagnose, repair — on S1
- Firewall implementation: students receive a written specification (e.g. "block ICMP from the Windows host, permit SSH only from S2, allow DNS from LAN1") and implement it on S1 using the tool of their choice — IPTables, NFTables, or UFW. Verified with a targeted tcpdump capture, not just a rule listing.
- Log diagnosis: a pre-seeded
auth.log is placed on S1. Students identify the attacking IP address, the time of the successful breach, and the commands run as root afterward.
- rsyslog repair: a deliberately broken rsyslog configuration (a syntax error or a misdirected rule) is waiting on S1. Students diagnose and fix it so logging resumes, confirmed by triggering a new log entry.
Before the practical starts: confirm the seeded auth.log and the broken rsyslog config are in place on every S1 — deploy them right after collecting written papers, not before, so no one gets a head start.
1:45 – 2:00Review + Week 3 Preview · 15 min
- Go over the most common written-section mistakes and the most common practical sticking points (usually the rsyslog repair).
- Preview Week 3: DHCP and DNS — the two services that let machines find each other by name. The DNS zones built there are referenced in every remaining week.
Mini-Assessment 2 — Topic Coverage
| Topic | Weight | Source |
|---|
| tcpdump flags, BPF filters, capture vs. display | 15% | Monday |
| Mausezahn syntax and packet crafting | 10% | Monday |
| IPTables / NFTables / UFW rule syntax and DROP vs. REJECT | 25% | Tuesday |
| NTP stratum hierarchy and ntpq -p columns | 15% | Wednesday |
| Syslog facility/severity and rsyslog routing rules | 15% | Thursday |
| Practical: firewall implementation + log diagnosis + rsyslog repair | 20% | All week |
What you need ready before class
Mini-Assessment 2 written papers printed
Seeded auth.log staged, ready to deploy to each S1
Broken rsyslog config staged, ready to deploy to each S1
Firewall specification handout printed