Network Intrusion Analysis
Domain 4, Network Intrusion Analysis, is about 20%. It tests protocol-level reading of packets and flows, recognition of scan and exfiltration patterns, and interpretation of IDS output.
Packet fundamentals
- TCP opens with SYN → SYN/ACK → ACK; flags are SYN, ACK, FIN, RST, PSH, URG. Sequence and acknowledgment numbers reveal retransmissions and session state.
- Scan signatures: a SYN scan sends SYN to many ports; open ports answer SYN/ACK, closed ports answer RST/ACK. NULL (no flags), FIN and XMAS (FIN+PSH+URG) scans rely on closed ports returning RST.
- Layer 2 attacks: ARP spoofing (gratuitous ARP, conflicting IP-to-MAC mappings), DHCP starvation, VLAN hopping.
- DNS abuse: tunneling shows long, high-entropy labels and high query volume to one domain; DGA shows many NXDOMAIN responses to random names.
- HTTP and TLS: inspect methods, URI, user-agent, status codes and upload size; TLS leaves SNI in the ClientHello and certificate metadata visible.
Detection logic
Signature IDS matches known patterns; anomaly detection baselines behavior. A Snort rule reads action, protocol, source, source port, direction, destination, destination port, then options such as msg, content and sid. Beaconing appears as regular connections, often with jitter, to the same destination.
Worked example
A capture shows 10.1.5.20 sending 300 queries in 60 seconds, all to a7f3.example.net, with labels like Zk9Qm2... and many TXT queries. No matching HTTP traffic appears.
Reasoning: normal DNS is low-volume with recognizable names. High-entropy labels, TXT records and one authoritative domain fit DNS tunneling for command and control or exfiltration. Confirm with the resolver logs, flow byte counts, and whether the host resolves other random domains. Evidence: source host, resolver, domain, query type, volume, time window.
Traps
- Calling one packet proof of compromise.
- Reversing initiator and responder; the client sends the first SYN.
- Reading RST/ACK as "open".
- Forgetting NAT hides internal addresses from external captures.
- Expecting payload visibility inside TLS.
- Confusing IDS (detects) with IPS (blocks).