Unit 2: Packet Analysis¶

Introduction¶

In Unit 1, you learned how networks function and how devices communicate. In this unit, we move deeper into the actual data units being transmitted: packets.

Packet-level analysis allows security professionals to detect scanning, intrusion attempts, malware communication, denial-of-service attacks, and data exfiltration.

Rather than analyzing dashboards or alerts (as in SIEM systems), packet analysis focuses on the raw network traffic itself.

—

Foundations of Network Communication¶

Packet analysis requires understanding layered communication using the OSI model.

OSI Model¶

+-------------------+
| 7  Application    |
+-------------------+
| 6  Presentation   |
+-------------------+
| 5  Session        |
+-------------------+
| 4  Transport      |
+-------------------+
| 3  Network        |
+-------------------+
| 2  Data Link      |
+-------------------+
| 1  Physical       |
+-------------------+

Security investigations most often focus on:

Layer 2 — MAC and ARP anomalies
Layer 3 — IP addressing and routing behavior
Layer 4 — TCP/UDP ports and flags
Layer 7 — Application protocols (HTTP, DNS, SMTP)

Understanding which layer an issue belongs to helps narrow the scope of analysis.

—

Anatomy of a Packet¶

Every network packet contains structured headers followed by data.

Packet Structure¶

+---------------------+
| Ethernet Header     |  (MAC addresses)
+---------------------+
| IP Header           |  (Source/Destination IP)
+---------------------+
| TCP/UDP Header      |  (Ports, Flags)
+---------------------+
| Payload             |  (Application Data)
+---------------------+

Key Header Fields¶

Field	Security Relevance
Source IP	Attacker origin
Destination IP	Target system
Source Port	Client process identification
Destination Port	Service being accessed
TCP Flags	Scanning / DoS indicators
TTL	Routing anomalies

These fields provide critical forensic insight.

—

Traffic Collection Theory¶

Before analysis begins, traffic must be captured.

Methods of Capture¶

Network TAP
SPAN / Mirror port
Host-based capture
Inline security appliance

Passive capture is preferred for forensic integrity because it does not modify traffic.

Capture files are commonly stored as:

.pcap
.pcapng

—

Analytical Methodology¶

Structured Analysis Process¶

Establish baseline traffic behavior
Filter relevant conversations
Identify anomalies
Correlate across layers
Form and test hypotheses

A structured approach prevents jumping to conclusions.

—

Identifying Security Issues by Layer¶

Layer 2 — ARP Spoofing¶

Indicators:

Multiple ARP replies for the same IP
Conflicting MAC-IP mappings
Unsolicited ARP responses

Security risk:

Man-in-the-middle interception

—

Layer 3 — IP-Based Threats¶

Suspicious indicators:

External communication outside expected geography
High-frequency connection attempts
Repeated failed routing attempts

—

Layer 4 — Transport Threat Patterns¶

Port Scanning Pattern¶

Attacker → SYN (Port 21)
Attacker → SYN (Port 22)
Attacker → SYN (Port 23)
...
No completed handshakes

Typical signature:

SYN flag set
No ACK response

SYN Flood (Denial of Service)¶

Characteristics:

Large volume of SYN packets
Few completed sessions
Resource exhaustion

Brute Force¶

Indicators:

Repeated login attempts
Numerous short-lived TCP sessions
High authentication failure rate

—

Application-Layer Threats¶

DNS Tunneling¶

Indicators:

Long, encoded subdomains
High request frequency
Uniform query size

Example suspicious pattern:

dGhpcy1sb29rcy1lbmNvZGVk.example.com
Y29tbWFuZC1hbmQtY29udHJvbA.example.com

Command and Control (C2)¶

Behavioral pattern:

Periodic beaconing
Fixed interval communications
Consistent packet size

Example time-based pattern:

Time (seconds)
|
|   *       *       *       *
|-----------------------------------
     60s     120s    180s    240s

Periodic intervals suggest automated communication.

—

Behavioral and Statistical Analysis¶

Packet Size Distribution Graph¶

Typical distribution:

Packet Count
|
|       *****
|      *******
|  *****
| **
|-----------------------------------
    64   512   1024   1500 bytes

Anomalies may include:

Excessive maximum-sized packets (possible exfiltration)
Large volumes of small packets (possible scanning)

Example Python Code to Generate Histogram¶

import matplotlib.pyplot as plt

packet_sizes = [60, 64, 512, 1500, 60, 64, 1500, 1500, 512]
plt.hist(packet_sizes, bins=10)
plt.title("Packet Size Distribution")
plt.xlabel("Packet Size (Bytes)")
plt.ylabel("Frequency")
plt.show()

—

Traffic Volume Over Time¶

Traffic spike visualization:

Bandwidth
|
|              ***********
|              ***********
|      *****
|------------------------------------
     09:00   10:00   11:00   12:00

Sudden spikes may indicate:

Data exfiltration
Malware updates
Denial-of-service attacks

Example Chart Code¶

import matplotlib.pyplot as plt

time = ["09:00","10:00","11:00","12:00"]
traffic = [200, 300, 1500, 250]

plt.plot(time, traffic)
plt.title("Network Traffic Over Time")
plt.xlabel("Time")
plt.ylabel("MB Transferred")
plt.show()

—

Encryption Considerations¶

Encrypted traffic limits payload inspection, but metadata remains visible:

Destination IP
TLS certificate details
Session timing
Packet size
Frequency

Encrypted command-and-control detection relies heavily on:

Timing analysis
Beacon interval detection
Anomalous volume profiling

—

Threat Indicator Summary Table¶

Threat Type	Observable Indicators
Port Scan	Multiple SYN, incomplete handshakes
SYN Flood	High SYN rate, few ACKs
DNS Tunneling	Long encoded DNS queries
C2 Beaconing	Periodic outbound connections
Data Exfiltration	Large outbound transfers
ARP Spoofing	Duplicate MAC-IP mappings

—

Practical Application Framework¶

To apply packet-level analysis:

Capture representative traffic
Establish baseline behavior
Filter by suspicious IP, port, or protocol
Analyze timing patterns
Inspect session behavior
Correlate anomalies across layers
Document findings systematically

Required knowledge includes:

TCP handshake mechanics
Common port-service mappings
DNS resolution process
HTTP request/response structure
Basic TLS concepts

—

Ethical and Legal Considerations¶

Packet capture may expose:

Credentials
Personal communications
Sensitive business data

Monitoring must comply with:

Organizational policy
Legal authorization
Data protection regulations

Unauthorized interception may be illegal.

—

Summary¶

Packet-level analysis enables detection of:

Intrusion attempts
Malware communication
Denial-of-service attacks
Data exfiltration
Man-in-the-middle activity

Effective analysis depends on:

Protocol knowledge
Behavioral pattern recognition
Statistical anomaly detection
Structured methodology

—

Quiz¶

Choose the best answer.

Which OSI layers are most commonly analyzed for security investigations?
1. Layers 1, 2, and 7
2. Layers 2, 3, 4, and 7
3. Layers 5, 6, and 7
4. All layers equally
Which header field identifies the service being accessed?
1. Source IP
2. Source Port
3. Destination Port
4. TTL
Why is passive capture preferred in forensic investigations?
1. Improves encryption visibility
2. Modifies traffic
3. Preserves forensic integrity
4. Blocks malicious traffic
SYN packets sent to many ports without completing handshakes indicate:
1. DNS tunneling
2. Brute force
3. Port scanning
4. Data exfiltration
A common indicator of ARP spoofing is:
1. High TTL
2. Duplicate MAC-IP mappings
3. Large outbound transfers
4. DNS errors
DNS tunneling often includes:
1. High SYN rate
2. Long encoded subdomains
3. Fragmented IP packets
4. Large certificates
In encrypted analysis, what remains visible?
1. Passwords
2. Payload contents
3. Packet size and timing
4. Form submissions
A sudden outbound spike may indicate:
1. ARP resolution
2. TCP handshake
3. Data exfiltration
4. DNS caching
Periodic outbound connections suggest:
1. ARP spoofing
2. C2 beaconing
3. Port scanning
4. Fragmentation
What is the first structured analysis step?
1. Identify anomalies
2. Establish baseline traffic behavior
3. Correlate across layers
4. Form hypotheses

—

Answer Key¶

Multiple Choice

— End of Unit 2