Hands-on network reconnaissance work: enumerating live hosts and open services, fingerprinting the target OS, and inspecting captured traffic for anomalies. Nmap was used for scanning and service/version detection, while Wireshark was used to review the resulting packet captures.

Port scanning and service enumeration: identified open TCP ports and the exact service/version running on each with Nmap

OS fingerprinting: used Nmap's TCP/IP stack analysis to identify the target's operating system

Traffic analysis: reviewed packet captures in Wireshark to flag retransmissions, duplicate ACKs, and connection resets