Finding the Scan in the Logs

By the end of this lesson you can explain what a log entry and a timestamp are, use grep and grep -c to find and count lines in a log, recognise the "one source, many ports, a few seconds" pattern of a scan, match it to the scan's start time, and list the first questions a defender asks. There is no lab in this lesson: every command is shown together with the exact result it prints. The logs come from the lab web server web01 (10.0.0.20) and record the authorized scan from the last lesson, which started at 10:20 UTC from 10.0.0.5.