# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 4 Guided Learning, Hands-On: Course Plan and Execution Strategy
### Initial Scouting/Reconnaissance Procedures
The analysis of ARP traffic also serves to show trainees how stealthiness can be easily thwarted by carelessness--a fatal failure for an attacker or during a red team CTF exercise, since an intruder host making or replying to ARP requests may generate unwanted \"noise\", leading to its disclosure. To deal with this, students are taught about the Linux _arp_ignore_ and _arp_announcure_ ssctl variables [33], and how to use them to reduce/supress ARP traffic. Once the initial capture analysis in concluded, students progress to the network scanning procedures, using the _arpscan_[34] and NMAP [35] tools. Both are well-maintained, open-source and portable tools, albeit NMAP has a more complete feature set and a powerful command line interface and scripting capabilities, also being able to integrate with other toolchains. Students will be asked to scan the entire network range, in order to detect active hosts, and in some cases also using spoofed IP addresses. Moreover, they are reminded about the need to perform a slow scan, because of the specific characteristics of ICS environments, albeit a professional attacker would probably do it anyway, in order to go unnoticed by intrusion detection techniques based on volumetric network traffic analysis. The first attempts are to be undertaken using the _arpscan_ tool (see Figure 15). Trainees will quickly develop an intuition about the trade-off between stealthiness and information gathering potential--for instance, total suppression of the ARP protocol and use of a IP-less network interface may limit the effectiveness of many techniques (for instance, ARP scans will not properly work with total ARP suppression). Figure 14: Good practices for ICS pentesting and scouting procedures. reveal/confirm many findings, namely, the IP and MAC addresses of the M340 PLC, the location of the HMI and SCADA stations and some potential insights about the Arduino-based RTU needs to be analyzed with special attention. While the PLCs and HMIs exhibit a traffic signature which is expected from a regular Modbus polling cycle, the Arduino-based RTU exhibits an unusual pattern in terms of ARP requests and TCP/IP traffic, with a MAC address prefix that seems very unlikely for this kind of hardware. The reasons for this are deeply rooted in the nature of the Wiznet W5100 network interface Application-Specific Integrated Circuit (ASIC), as well as in the limitations of a simple microcontroller, on which the Arduino is based upon. Thus, instructors provide a series of clues (Wiznet W5100 ASIC datasheets [20], discussion about the Arduino Modbus library implementation) which are expected to lead students to find an answer for the unusual patterns. During this module, and according with the background and skill level of the course attendees, instructors are advised to fill eventual knowledge gaps (for instance reviewing TCP/IP connection state diagrams or other required technical concepts), also encouraging (and giving time for) students to explore these concepts on their own. For student groups with a more advanced skillset, this step offers an interesting opportunity to explore OSINT techniques, which may be leveraged by students to make the most of the information that was gathered. Trainees are encouraged to work in groups (in some cases formed by the instructors' initiative, to balance skill levels), having to work autonomously at the end of the module to deliver a complete report about the findings.