A wide panel shows the annotated NetMon capture with its own callout boxes, "the endpoint mapper request" and "DRSR is the tower," while the switchboard operator from earlier reappears as a faint, transparent ghost overlaid on the screenshot, answering the phone. Captions read: "Right away, we see the endpoint mapper request... connecting to TCP port 135." and "The tower for Directory Replication is in that request, using the UUID E3514235-4B06-11D1-AB04-00C04FC2DCD2."
The response frame is annotated with callouts on "the tower(s) containing the floors" and "the floor contains the server application port," while the switchboard-ghost operator hands the protagonist's dream-self a slip of paper with a port number on it. A caption reads: "You can see the towers... and the floors in each tower with their ports... a specific server port is listed."
A small bouncer character in a bow tie blocks a velvet rope, examining a Kerberos ticket held up by a client-side LSASS icon; small print on the ticket reads "Realm: COHOWINERY.COM." A caption reads: "Because this is MSRPC and domain controllers, this means Kerberos and packet privacy are required."