Response Content (0dcbbf4f-929c-489a-b66b-9b820d3f7f0e)
Captured network traffic that provides details about responses received during an internet scan. This data includes both protocol header values (e.g., HTTP status codes, IP headers, or DNS response codes) and response body content (e.g., HTML, JSON, or raw data). Examples:
- HTTP Scan: A web server responds to a probe with an HTTP 200 status code and an HTML body indicating the default page is accessible.
- DNS Scan: A DNS server replies to a query with a resolved IP address for a domain, along with details like Time-To-Live (TTL) and authoritative information.
- TCP Banner Grab: A service listening on a port (e.g., SSH or FTP) responds with a banner containing service name, version, or other metadata.
Data Collection Measures:
- Network Traffic Monitoring:
- Deploy packet capture tools like Wireshark, tcpdump, or Suricata to log both headers and body content of response traffic.
- Use network appliances like firewalls, intrusion detection systems (IDS), or intrusion prevention systems (IPS) with logging enabled to capture scan responses.
- Cloud Logging Services:
- AWS VPC Flow Logs: Capture metadata about network flows, including source and destination, protocol, and response codes.
- GCP Packet Mirroring: Use mirrored packets to analyze responses.
- Azure NSG Flow Logs: Record network traffic flow information for analysis.
- Specific Tools:
- Zmap or Masscan: Can perform internet-wide scans and collect response content for analysis.
- Nmap: Use custom scripts to capture and log detailed response data during scans.