A University uses a card transaction system that allows students to purchase goods using their student ID. Students can put money on their ID at terminals throughout the campus. The security…

Notifying the vendor is a remediation step, not a method for reproducing or understanding the attack mechanism.

A protocol analyzer captures raw network traffic between student devices and the transaction terminals, allowing the administrator to inspect the exact frames and data fields the system uses. By reverse engineering the protocol, the administrator can understand how card balances are encoded and transmitted, then reproduce the manipulation steps the students performed. This is a standard ethical hacking reconnaissance technique used before attempting to replicate an attack in a controlled environment.

Threatening students with disciplinary action does not provide any technical insight into how the attack works or allow the administrator to reproduce it.

Installing a NIDS monitors future network traffic for known signatures but does not help the administrator understand or reproduce the specific technique already used.