Lion Cipher Lab
Monitor your machine's network connections with ss and netstat
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
Almost every real security investigation eventually asks one small, concrete question: what is this machine listening for, and who is it actually talking to? Malware that opens a backdoor has to listen on a port; a machine that has been recruited into a botnet or is exfiltrating data has to hold a connection open to somewhere. Before you can spot the abnormal, you have to be fluent in the normal — able to list your own machine's open sockets and, crucially, tie each one back to the program that opened it. That skill (endpoint network visibility) is assumed on day one in a SOC and on every…
What you'll learn
- endpoint network visibility
- listening vs established connections
- mapping a socket to a process/PID
- reading ss / netstat output
- spotting an unexpected listener or beacon
Steps in this lab
- The words you need first: port, socket, listening, established, PID
- Open a terminal and pick your tool per OS
- List what your machine is LISTENING for (open doors)
- List who you're TALKING TO (established connections)
- Map a socket back to its process (the key move)
- Spot the unexpected: an unknown listener, a beacon to nowhere good
- Investigate and, if warranted, shut it down
- The honest limits — and where this goes next