Network Protocols and Traffic Analysis
This domain tests protocol-level reconstruction: can you explain what happened from packets, flows, and logs rather than from an alert label? Expect TCP flag analysis, DNS and DHCP correlation, HTTP/TLS metadata, ICMP behavior, and tunneling indicators.
Core rules
Start at the frame level, then aggregate to conversations and flows. In TCP, the three-way handshake establishes state; sequence and acknowledgment numbers reveal retransmissions, resets, and data gaps. A SYN without completed handshake suggests scanning, filtering, or outage. Source ports above 1024 are usually ephemeral, so service identification should use destination ports, payload signatures, and banners, not port number alone.
DNS queries and responses map names to addresses and expose beaconing, DGA domains, and tunneling. DHCP leases bind IP, MAC, and lease time, which is essential when NAT hides hosts. ARP maps IP to MAC on a LAN but is spoofable. TLS metadata-SNI, certificate subject, JA3-can characterize encrypted sessions without decrypting payload. ICMP can carry covert data, so inspect type, code, size, and frequency.
Worked example
A capture shows one internal host sending 300 SYNs to sequential destination ports on a single external IP, with almost no SYN-ACKs. The internal source port changes, TTL is consistent, and the host also queries many nonexistent DNS names. Reasoning: the SYN pattern indicates a vertical port scan; the DNS pattern is separate and may indicate DGA. Do not call it exfiltration without payload or volume evidence.
Traps
Treating every external IP as malicious; confusing NAT with the true endpoint; ignoring retransmissions as packet loss; and assuming encrypted traffic is unanalyzable. Also watch out for fragmented packets and nonstandard ports.