Network Architecture, Protocols, and Traffic Analysis
Protocol mechanics the exam probes
- TCP opens with SYN, SYN/ACK, ACK; sequence and acknowledgment numbers let you spot retransmissions, resets, and injected packets. RST mid-session often means a middlebox or a hostile teardown; PSH flags push data to the application.
- DNS record types: A and AAAA for address, CNAME for alias, MX for mail, NS for delegation, TXT for arbitrary text (a favorite tunneling channel), SOA for zone authority.
- DHCP is DORA: Discover, Offer, Request, Acknowledge.
- TLS 1.3 handshake is one round trip, forward secret by default via ECDHE, with SNI still visible unless Encrypted Client Hello is in use.
Traffic analysis method
Work from flows before packets. NetFlow or IPFIX shows who talked to whom and how much; only then pull PCAP. Beaconing signatures: near-constant inter-arrival intervals with low jitter, uniform payload sizes, a single destination, and long-lived low-volume sessions. JA3/JA4 fingerprints the client TLS stack and survives IP rotation.
Worked example
A workstation sends DNS queries five minutes apart to random-looking 60-character base32 labels under one domain, and receives TXT responses of about 200 bytes. Reasoning: normal DNS names are short, human-readable, and low-entropy. High-entropy labels under a single parent, paired with oversized TXT responses, indicate DNS tunneling for command and control or exfiltration (ATT&CK T1071.004). Confirm by comparing query volume to the host baseline and checking whether the parent domain is newly registered.
Traps that cost marks
Assuming port 443 always means HTTPS; assuming a single SYN means scanning; treating a CDN edge IP as a dedicated C2 server; forgetting that ARP spoofing is layer 2 while DNS spoofing is application layer.