Network Traffic Analysis and Intrusion Detection
Network Traffic Analysis and Intrusion Detection tests packet- and flow-level investigation: reading PCAPs, querying Zeek logs, interpreting IDS alerts, and recognizing command-and-control or exfiltration patterns even when traffic is encrypted.
Core rules
- Separate flow data from full content. Zeek conn.log gives the five-tuple, duration, bytes, and connection state; http.log, dns.log, ssl.log, and files.log add protocol detail. PCAP gives payload but is expensive to store.
- Use capture filters (BPF) to reduce volume and display filters to isolate conversations. In Wireshark, tcp.stream eq N and http.request.method == "POST" are staples.
- Treat IDS alerts as leads, not verdicts. Suricata and Snort rules can fire on signatures that are benign in context; validate against host and authentication telemetry.
- Beaconing shows as regular intervals with jitter, small consistent payloads, and repeated DNS or TLS connections to the same destination. JA3/JA3S and SNI help classify TLS clients and servers.
Worked example
Zeek dns.log shows a workstation querying a random-looking domain every 60 seconds with slight jitter, and conn.log shows short TLS sessions to one IP with near-constant byte counts. Reasoning: periodicity plus low, uniform volume is more consistent with C2 check-in than browsing. Pivot to the endpoint to identify the responsible process before blocking the domain, because blocking alone loses the loader.
Traps
- Examining only north-south traffic and missing east-west lateral movement.
- Assuming encrypted traffic is unanalyzable; metadata still tells a story.
- Applying a capture filter that excludes the traffic you need.
- Accepting an IDS alert without corroboration.
- Confusing a high-volume transfer with exfiltration without checking direction and host role.