Introduction
River Festival needs an access review before opening its network. Guests and staff should both read the public schedule; check-in and supplies are staff-only. Your task is to observe the same server from both network positions and deliver an accurate review, including unexpected access and unavailable required services.
Guest Scanner and Staff Scanner are persistent terminals in separate network namespaces on one training VM. They have distinct routes and source addresses but share files; they are not independent VMs. The environment is prepared, and all data is synthetic. Only server 10.77.3.2 and TCP ports 8311,8322,8333 are authorized scan targets. Preserve the clients, routes, filter rules, services, data and packet observers. This is an observation-only task: a correct review may show that the network is not ready to open.
Basic terminal input and paths are sufficient. Necessary Nmap, HTTP and shell syntax is explained; Finding the Live Workshop Service is recommended preparation. No firewall administration or programming is required.
Establish a Working Control from Both Sources
In this step, you will see the normal public business from each network before judging restricted access. Use the named lab tabs, not a server or management shell. Opening a scanner tab enters its prepared network without rebuilding it. Each terminal's directory and shell state are separate; their files are on the same VM.
Guest Scanner
Select the Guest Scanner tab. cd changes this shell's working directory; subsequent relative paths refer to it:
cd /home/labex/project/nmap-access/guest
cat displays a text file. .. refers to the parent directory, so the following path reads the shared agreement above this role's directory:
cat ../plan.csv
CSV means comma-separated values: a header names the columns, followed by one relationship per row. The six rows pair guest or staff with a service and TCP port. allow requires a working connection; block requires that this source cannot connect. The public schedule on 8311 is allowed from both sources. Check-in on 8322 and supplies on 8333 are staff-only.
HTTP is the request/response protocol used by these services. curl fetches a URL. The combined -fsS options fail on HTTP errors, hide the progress meter and still display errors; -o saves the response to the following filename. The address selects the destination, the port after the colon selects its listener, and /manifest.csv selects the resource:
curl -fsS -o public.csv http://10.77.3.2:8311/manifest.csv
cat public.csv
Expect the header and two schedule/RIVER-FEST records: P01/Doors at 10 and P02/Talk at 11. This is a real response from the guest network position, whose source address is 10.77.1.2.
Staff Scanner
Switch to the Staff Scanner tab. Its source is 10.77.2.2, and its role directory is separate:
cd /home/labex/project/nmap-access/staff
curl -fsS -o public.csv http://10.77.3.2:8311/manifest.csv
cat public.csv
Expect the same two complete public records. A working public control on both sides prevents treating a disconnected scanner as successful blocking. The two public.csv files live in different role directories. If a filename is mistyped, read the error, use pwd to show this terminal's directory, and repeat its displayed cd before retrying. Do not repair routes or restart services.
Scan the Same Services from Each Network
In this step, you will collect complete observations from both sources. A port state describes what this scanner observed, not an intrinsic property of the server. open means it accepted a TCP connection. closed means the scan received a rejection; that can come from a missing listener or a rejecting filter. filtered means Nmap could not determine whether the port is open because probes or responses were blocked. Do not infer a specific root cause from a state alone.
Nmap examines network services. -sT selects TCP connect scanning, which does not need raw-packet privileges here. -Pn skips the preliminary host-discovery decision and examines the stated ports even if other probes are not answered; it does not itself prove the host is alive. -n skips reverse name resolution. --reason displays the response basis, -p chooses the complete allowed port set, and -oX saves structured XML along with the normal terminal output. The default common-port set would not replace this agreement.
The Nmap Scripting Engine, NSE, can send a selected application request. --script selects one script, and --script-args supplies its named options. http-title retrieves an HTML title; http-title.url=/about selects the descriptive resource. All three candidates here are declared HTTP services. The leading + explicitly runs only this script despite an unrecognized port, within this known HTTP scope. It is not a general instruction to force arbitrary scripts on unrelated services. Product-version text is not required.
Guest Scanner
Switch to Guest Scanner, still in /home/labex/project/nmap-access/guest. Use --script-help to read the selected script's help first:
nmap --script-help http-title
nmap -sT -Pn -n --reason --script=+http-title --script-args=http-title.url=/about -p 8311,8322,8333 -oX scan.xml 10.77.3.2
Wait for Nmap done. Expect 8311 and 8322 open, with actual public-schedule and staff-check-in titles. Expect 8333 filtered. The guest can reach a staff-only service, so the public control's success was not a complete access review.
Staff Scanner
Switch to Staff Scanner, still in /home/labex/project/nmap-access/staff. Run the same bounded inspection from this network position:
nmap -sT -Pn -n --reason --script=+http-title --script-args=http-title.url=/about -p 8311,8322,8333 -oX scan.xml 10.77.3.2
Expect 8311 and 8322 open, and 8333 closed. Staff therefore cannot connect to a required service. The title replies identify responsive HTTP candidates; a conventional SERVICE name by itself does not prove the application.
These are two real scans, not one result renamed for two sources. Their role-specific scan.xml files and existing source traffic support the review. If you used the wrong tab, target or ports, rerun the corrected full scan from the proper scanner. If interrupted, wait for a complete rerun. Renaming text to XML or copying the other role's file does not create missing source observations.
Deliver the Access Review and Preserve the Scene
In this step, you will turn the six observed relationships into an accurate handover review. Start in Staff Scanner, in /home/labex/project/nmap-access/staff. Keep the original scene unchanged; a review can be complete while access still needs later repair.
For an allow row, open meets the agreement; closed or filtered means unavailable. For a block row, an open port is unexpected-open; closed or filtered meets the observed connection restriction. This conclusion applies to the stated source, target, protocol, ports and observation time. It is not a guarantee about every network path or the exact cause of a rejection.
The report columns are source,service,port,expected,observed,verdict. Keep the source and service tied to their own evidence. Record the actual state rather than replacing every non-open result with the same word. The agreement requires staff supplies even though its current state is closed, so it is a finding, not successful blocking.
A quoted here-document passes the following literal lines to cat. > replaces only the named report; the final CSV must be alone on its line. ../access-review.csv places the shared review in the parent directory:
Staff Scanner
cat > ../access-review.csv <<'CSV'
source,service,port,expected,observed,verdict
guest,schedule,8311,allow,open,meets
guest,checkin,8322,block,open,unexpected-open
guest,supplies,8333,block,filtered,meets
staff,schedule,8311,allow,open,meets
staff,checkin,8322,allow,open,meets
staff,supplies,8333,allow,closed,unavailable
CSV
cat ../access-review.csv
Hold network opening: guest check-in is unexpectedly reachable, and staff supplies is unavailable. Do not remove an exposure or change a filter to make this report easier; this task delivers findings to the owner. The same state can have different implications under different allow/block relationships.
Guest Scanner
Switch to Guest Scanner and use the unchanged public control again:
curl -fsS -o public.csv http://10.77.3.2:8311/manifest.csv
Staff Scanner
Return to Staff Scanner and do the same:
curl -fsS -o public.csv http://10.77.3.2:8311/manifest.csv
Both must still supply the original two public records. The private services and original network configuration also remain in place for investigation. If a URL was mistyped, correct the known URL and retry from the same role rather than copying the other side's download.
Summary
You established normal business from both sources, collected separate Nmap observations, and reviewed every access relationship. Unexpected reachability and unavailable required services are different findings. The completed review preserves the original scene and limits its conclusions to the actual sources and scope observed.
