I85PREP
⌘ K
eCDFP study materials
eCDFP study resources

eCDFP: Network Defense and Traffic Analysis

eCDFP · Work through your exam, one topic at a time.

All guide sections

Network Defense and Traffic Analysis

This domain tests whether you can read packets and flow records, understand normal protocol behaviour and spot malicious patterns in pcaps, Zeek logs and NetFlow. Questions typically give you a capture or log excerpt and ask what the traffic proves.

Core rules and concepts

  • Packet vs flow. A pcap keeps headers and payload but is heavy; NetFlow/IPFIX keeps session metadata (five-tuple, byte counts, timestamps, TCP flags) and scales, but no content. Start from flows to find the conversation, pivot to pcap for proof.
  • TCP behaviour: the SYN / SYN-ACK / ACK handshake, RST for refusal or teardown, retransmissions. Wireshark shows relative sequence numbers by default, which hides the true initial sequence number and can mask evasion.
  • Display filters vs capture filters. BPF capture syntax tcp port 443 differs from Wireshark display syntax tcp.port == 443 && ip.addr == 10.1.1.5. BPF port 53 matches both UDP and TCP.
  • Zeek logs: conn.log (uid, orig and resp bytes, duration, connection state), dns.log, http.log, ssl.log (SNI, JA3), files.log. Correlate records by uid.
  • Beaconing signals: low-jitter intervals, small uniform payloads, long session durations, repeated DNS lookups to one parent domain.
  • DNS tunnelling signals: many TXT or NULL queries, long random labels, high entropy, many unique subdomains of one domain, large response sizes.
  • TLS still leaks: SNI, certificate metadata, JA3/JA3S fingerprints, packet sizes and timing. Encryption hides content, not destination.
  • Lateral movement ports: SMB 445, RDP 3389, WinRM 5985/5986, NTLM authentication chatter.

Worked example

Zeek conn.log shows 40 internal hosts contacting one external IP roughly every 300 seconds with +/-2 seconds of jitter, each sending 180-220 bytes and receiving about 90 bytes, sessions lasting hours. A single DNS lookup for the IP's domain occurs at start. Fixed interval plus tiny uniform payload plus long duration means automated check-in, not browsing. Next steps: pull one session in pcap, extract SNI and JA3, and check whether the same JA3 appears from all 40 hosts, which points to one implant family. Block on the TTP and JA3, not only the IP.

Traps that cost marks

Assuming TLS traffic is invisible; reading Wireshark relative sequence numbers as absolute; ignoring east-west traffic; mistaking NTP or software updates for beacons (check jitter and user-agent); writing ip.addr == x when you meant ip.src == x.

Key points

  • Flows find the conversation; pcaps prove the content.
  • BPF capture filters and Wireshark display filters use different syntax.
  • Correlate Zeek records by uid across conn, dns, http and ssl logs.
  • Low jitter plus uniform small payloads indicates beaconing.
  • Encrypted traffic still exposes SNI, JA3 and timing.