Network Intrusion Analysis: Packets, Scans, and Abuse Patterns
Read the packet, then read the pattern
Start with the 5-tuple: source IP, source port, destination IP, destination port, protocol. Most flow, firewall, and PCAP questions reduce to comparing tuples and direction.
TCP basics appear constantly: the three-way handshake (SYN, SYN-ACK, ACK), teardown (FIN/ACK pairs or RST), and the flags SYN, ACK, FIN, RST, PSH, URG. A flood of SYNs from many sources to one destination with no completed handshakes is a SYN flood. A SYN scan leaves SYN → SYN-ACK → RST; a full-connect scan completes the handshake; NULL/FIN/XMAS scans use unusual flag combinations to evade filters. Many destinations on one port from one source is a horizontal scan; one destination across many ports is vertical.
Protocol abuse patterns:
- DNS tunneling/exfiltration: long or high-entropy labels, many TXT/NULL queries, high query volume to one domain.
- ICMP tunneling: large or frequent ICMP payloads carrying data.
- ARP spoofing/MITM: duplicate ARP replies mapping one IP to two MACs, gratuitous ARP, MAC flapping.
- Beaconing: callbacks at near-fixed intervals - timing regularity matters more than volume.
- Exfiltration: large outbound transfers or unusual ports against the baseline.
Tools: Wireshark for deep inspection and display filters (e.g., tcp.flags.syn == 1 && tcp.flags.ack == 0); tcpdump for capture and BPF filters (tcpdump -i eth0 port 53 -w dns.pcap); firewall, proxy, and DNS logs for the same patterns at scale.
Worked example: an internal host sends roughly 30 DNS queries per minute to random-looking subdomains of one domain, each with a long label, receiving small TXT responses. Normal DNS is short, repetitive names at low volume. Verdict: probable DNS tunneling - pivot to endpoint telemetry and block the domain.
Rule of thumb: normal traffic is repetitive and symmetric; malicious traffic is regular in timing but odd in naming, volume, or direction.