Detection Indepth Pdf 258 - Sec503 Intrusion

On Page 258 (or the associated lab), there is often a five-packet capture sequence. Do not look at the solution first.