Unit 2: Packet Analysis ======================= Introduction ------------ In Unit 1, you learned how networks function and how devices communicate. In this unit, we move deeper into the actual **data units** being transmitted: packets. Packet-level analysis allows security professionals to detect scanning, intrusion attempts, malware communication, denial-of-service attacks, and data exfiltration. Rather than analyzing dashboards or alerts (as in SIEM systems), packet analysis focuses on the raw network traffic itself. --- Foundations of Network Communication ------------------------------------ Packet analysis requires understanding layered communication using the OSI model. OSI Model ^^^^^^^^^ :: +-------------------+ | 7 Application | +-------------------+ | 6 Presentation | +-------------------+ | 5 Session | +-------------------+ | 4 Transport | +-------------------+ | 3 Network | +-------------------+ | 2 Data Link | +-------------------+ | 1 Physical | +-------------------+ Security investigations most often focus on: - Layer 2 — MAC and ARP anomalies - Layer 3 — IP addressing and routing behavior - Layer 4 — TCP/UDP ports and flags - Layer 7 — Application protocols (HTTP, DNS, SMTP) Understanding which layer an issue belongs to helps narrow the scope of analysis. --- Anatomy of a Packet ------------------- Every network packet contains structured headers followed by data. Packet Structure ^^^^^^^^^^^^^^^^ :: +---------------------+ | Ethernet Header | (MAC addresses) +---------------------+ | IP Header | (Source/Destination IP) +---------------------+ | TCP/UDP Header | (Ports, Flags) +---------------------+ | Payload | (Application Data) +---------------------+ Key Header Fields ^^^^^^^^^^^^^^^^^ +----------------------+----------------------------------+ | Field | Security Relevance | +======================+==================================+ | Source IP | Attacker origin | +----------------------+----------------------------------+ | Destination IP | Target system | +----------------------+----------------------------------+ | Source Port | Client process identification | +----------------------+----------------------------------+ | Destination Port | Service being accessed | +----------------------+----------------------------------+ | TCP Flags | Scanning / DoS indicators | +----------------------+----------------------------------+ | TTL | Routing anomalies | +----------------------+----------------------------------+ These fields provide critical forensic insight. --- Traffic Collection Theory ------------------------- Before analysis begins, traffic must be captured. Methods of Capture ^^^^^^^^^^^^^^^^^^ - Network TAP - SPAN / Mirror port - Host-based capture - Inline security appliance Passive capture is preferred for forensic integrity because it does not modify traffic. Capture files are commonly stored as:: .pcap .pcapng --- Analytical Methodology ---------------------- Structured Analysis Process ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1. Establish baseline traffic behavior 2. Filter relevant conversations 3. Identify anomalies 4. Correlate across layers 5. Form and test hypotheses A structured approach prevents jumping to conclusions. --- Identifying Security Issues by Layer ------------------------------------ Layer 2 — ARP Spoofing ^^^^^^^^^^^^^^^^^^^^^^ Indicators: - Multiple ARP replies for the same IP - Conflicting MAC-IP mappings - Unsolicited ARP responses Security risk: - Man-in-the-middle interception --- Layer 3 — IP-Based Threats ^^^^^^^^^^^^^^^^^^^^^^^^^^ Suspicious indicators: - External communication outside expected geography - High-frequency connection attempts - Repeated failed routing attempts --- Layer 4 — Transport Threat Patterns ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Port Scanning Pattern ~~~~~~~~~~~~~~~~~~~~~ :: Attacker → SYN (Port 21) Attacker → SYN (Port 22) Attacker → SYN (Port 23) ... No completed handshakes Typical signature: - SYN flag set - No ACK response SYN Flood (Denial of Service) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Characteristics: - Large volume of SYN packets - Few completed sessions - Resource exhaustion Brute Force ~~~~~~~~~~~ Indicators: - Repeated login attempts - Numerous short-lived TCP sessions - High authentication failure rate --- Application-Layer Threats ------------------------- DNS Tunneling ^^^^^^^^^^^^^ Indicators: - Long, encoded subdomains - High request frequency - Uniform query size Example suspicious pattern:: dGhpcy1sb29rcy1lbmNvZGVk.example.com Y29tbWFuZC1hbmQtY29udHJvbA.example.com Command and Control (C2) ^^^^^^^^^^^^^^^^^^^^^^^^ Behavioral pattern: - Periodic beaconing - Fixed interval communications - Consistent packet size Example time-based pattern:: Time (seconds) | | * * * * |----------------------------------- 60s 120s 180s 240s Periodic intervals suggest automated communication. --- Behavioral and Statistical Analysis ----------------------------------- Packet Size Distribution Graph ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Typical distribution:: Packet Count | | ***** | ******* | ***** | ** |----------------------------------- 64 512 1024 1500 bytes Anomalies may include: - Excessive maximum-sized packets (possible exfiltration) - Large volumes of small packets (possible scanning) Example Python Code to Generate Histogram ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ .. code-block:: python import matplotlib.pyplot as plt packet_sizes = [60, 64, 512, 1500, 60, 64, 1500, 1500, 512] plt.hist(packet_sizes, bins=10) plt.title("Packet Size Distribution") plt.xlabel("Packet Size (Bytes)") plt.ylabel("Frequency") plt.show() --- Traffic Volume Over Time ^^^^^^^^^^^^^^^^^^^^^^^^ Traffic spike visualization:: Bandwidth | | *********** | *********** | ***** |------------------------------------ 09:00 10:00 11:00 12:00 Sudden spikes may indicate: - Data exfiltration - Malware updates - Denial-of-service attacks Example Chart Code ^^^^^^^^^^^^^^^^^^ .. code-block:: python import matplotlib.pyplot as plt time = ["09:00","10:00","11:00","12:00"] traffic = [200, 300, 1500, 250] plt.plot(time, traffic) plt.title("Network Traffic Over Time") plt.xlabel("Time") plt.ylabel("MB Transferred") plt.show() --- Encryption Considerations ------------------------- Encrypted traffic limits payload inspection, but metadata remains visible: - Destination IP - TLS certificate details - Session timing - Packet size - Frequency Encrypted command-and-control detection relies heavily on: - Timing analysis - Beacon interval detection - Anomalous volume profiling --- Threat Indicator Summary Table ------------------------------ +------------------+-----------------------------------------+ | Threat Type | Observable Indicators | +==================+=========================================+ | Port Scan | Multiple SYN, incomplete handshakes | +------------------+-----------------------------------------+ | SYN Flood | High SYN rate, few ACKs | +------------------+-----------------------------------------+ | DNS Tunneling | Long encoded DNS queries | +------------------+-----------------------------------------+ | C2 Beaconing | Periodic outbound connections | +------------------+-----------------------------------------+ | Data Exfiltration| Large outbound transfers | +------------------+-----------------------------------------+ | ARP Spoofing | Duplicate MAC-IP mappings | +------------------+-----------------------------------------+ --- Practical Application Framework ------------------------------- To apply packet-level analysis: 1. Capture representative traffic 2. Establish baseline behavior 3. Filter by suspicious IP, port, or protocol 4. Analyze timing patterns 5. Inspect session behavior 6. Correlate anomalies across layers 7. Document findings systematically Required knowledge includes: - TCP handshake mechanics - Common port-service mappings - DNS resolution process - HTTP request/response structure - Basic TLS concepts --- Ethical and Legal Considerations -------------------------------- Packet capture may expose: - Credentials - Personal communications - Sensitive business data Monitoring must comply with: - Organizational policy - Legal authorization - Data protection regulations Unauthorized interception may be illegal. --- Summary ------- Packet-level analysis enables detection of: - Intrusion attempts - Malware communication - Denial-of-service attacks - Data exfiltration - Man-in-the-middle activity Effective analysis depends on: - Protocol knowledge - Behavioral pattern recognition - Statistical anomaly detection - Structured methodology --- Quiz ---- Part A: Multiple Choice ~~~~~~~~~~~~~~~~~~~~~~~ Choose the **best answer**. 1. Which OSI layers are most commonly analyzed for security investigations? A. Layers 1, 2, and 7 B. Layers 2, 3, 4, and 7 C. Layers 5, 6, and 7 D. All layers equally 2. Which header field identifies the service being accessed? A. Source IP B. Source Port C. Destination Port D. TTL 3. Why is passive capture preferred in forensic investigations? A. Improves encryption visibility B. Modifies traffic C. Preserves forensic integrity D. Blocks malicious traffic 4. SYN packets sent to many ports without completing handshakes indicate: A. DNS tunneling B. Brute force C. Port scanning D. Data exfiltration 5. A common indicator of ARP spoofing is: A. High TTL B. Duplicate MAC-IP mappings C. Large outbound transfers D. DNS errors 6. DNS tunneling often includes: A. High SYN rate B. Long encoded subdomains C. Fragmented IP packets D. Large certificates 7. In encrypted analysis, what remains visible? A. Passwords B. Payload contents C. Packet size and timing D. Form submissions 8. A sudden outbound spike may indicate: A. ARP resolution B. TCP handshake C. Data exfiltration D. DNS caching 9. Periodic outbound connections suggest: A. ARP spoofing B. C2 beaconing C. Port scanning D. Fragmentation 10. What is the first structured analysis step? A. Identify anomalies B. Establish baseline traffic behavior C. Correlate across layers D. Form hypotheses --- Answer Key ---------- **Multiple Choice** 1. B 2. C 3. C 4. C 5. B 6. B 7. C 8. C 9. B 10. B --- End of Unit 2