Students play the role of a network security administrator of an enterprise. They are told that a host on the Internet has been persistently scanning their network.

They will use an Incident Response Rack with intrusion detection systems and log analysis tools to determine:

1. The service being targeted by the attacker.
2. If the attackers succeeds in finding and exploiting a vulnerability in this service.

Finally, they must block the attacker from the network.

After the attack is blocked, students will learn to exploit the vulnerability in the service.