CyberPlace CTF Challenges & Labs

A RIB has the following entries:
(a) 192.168.5.20/32 use eth1 towards 192.168.10.7
(b) 192.168.1.81/32 use eth1 towards 192.168.10.5
(c) 192.168.18.0/23 use eth0 towards www
(d) 192.168.64.0/18 use eth1 towards 192.168.10.5
(e) 192.168.128.0/18 use eth1 towards 192.168.10.7 and
(f) 0.0.0.0/0 use eth1 towards 192.168.10.20.

Determine where the following IP would be routed:
(1) 192.168.1.80
(2) 192.168.100.10
(3) 192.168.19.5

Detecting ARP Poisoning Attacks - Examine the ARP table capture (internet and physical addresses) from a host. Identify if an attack is taking place, name the attack, and specify the attacker's MAC address: [[192.168.1.1, 00-11-22-33-44-55],[192.168.1.105, aa-bb-cc-dd-ee-ff] ,[192.168.1.120, aa-bb-cc-dd-ee-ff]]

Detecting Fragmentation - Users report downloading large files freezes indefinitely. Review the raw packet trace below between a (10.4.0.12), b (198.51.100.10) and c (172.16.0.1). Identify anomaly and name the network phenomenon. [[1 a b TCP 1514 [ACK] Seq=1 Ack=1 Win=65535 Len=1448 Flags=[DF]],[2 a b TCP 1514 [ACK] Seq=1449 Ack=1 Win=65535 Len=1448 Flags=[DF]],[3 c a ICMP 70 Destination Unreachable (Fragmentation Needed, MTU=1380)],[4 a b TCP 1514 [Retransmission] Seq=1449 Ack=1 Win=65535 Len=1448 Flags=[DF]]]