Shimomura’s Analysis
Shimomura receives a report of intrusion
Notices inconsistencies in logs
Checks the host for last accessed files, libraries and suid programs
Uses tcpdump for traffic analysis
Detects that the attacker is searching for trust relationship
Detects Sequence Guessing attack