A(n) analyzes traffic patterns and compares them to known patterns of malicious behavior.

Usually, when we sniff packets, we are only interested certain types of packets. we can do that by setting filters in sniffing. scapy’s filter use the bpf (berkeley packet filter) syntax; you can find the bpf manual from the internet. set the following filters and demonstrate your sniffer program again (each filter should be set separately): (a) capture only the icmp packet. (b) capture any tcp packet that comes from a particular ip and with a destination port number 23. (c) capture packets comes from or to go to a particular subnet. you can pick any subnet, such as 128.230.0.0/16; you should not pick the subnet that your vm is attached to.

What is a loop? a. a collection of function definitions at the top of a program b. a line of code that defines a variable and assigns it a value c. a program that opens the turtle graphics window d. a block of code that repeats a specific number of times

Suppose you are an ad-serving company and you maintain a log of cookie data for ads you serve to the web pages for a particular vendor (say amazon). a. how can you use this data to determine which are the best ads? b. how can you use this data to determine which are the best ad formats? c. how could you records of past ads and ad clicks to determine which ads to send to a given ip address? d. how could you use this data to determine how well the technique you used in your answer to part c was working? e. how could you use this data to determine that a given ip address is used by more than one person? f. how does having this data give you a competitive advantage vis-à-vis other ad-serving companies?