Network traffic analysis in Cybersecurity - Step-by-Step Execution

Concept Flow - Network traffic analysis

Capture Network Packets

↓

Filter Relevant Traffic

↓

Inspect Packet Details

↓

Identify Patterns or Anomalies

↓

Generate Reports or Alerts

↓

Take Action (e.g., block, investigate)

Network traffic analysis starts by capturing data packets, then filtering and inspecting them to find patterns or unusual activity, leading to reports or security actions.

Execution Sample

Cybersecurity

1. Capture packets from network interface
2. Filter packets by IP or protocol
3. Inspect packet headers and payload
4. Detect unusual traffic patterns
5. Alert or log findings

This sequence shows the basic steps of analyzing network traffic to detect issues or threats.

Analysis Table

Step	Action	Input/Condition	Result/Output
1	Capture packets	Network interface active	Packets collected from network
2	Filter packets	Filter: TCP packets only	Only TCP packets remain
3	Inspect packets	Check source/destination IP and ports	Packet details extracted
4	Detect anomalies	Look for unusual IP or port usage	Suspicious packets flagged
5	Generate alert	Suspicious packets found	Alert sent to security team
6	Take action	Alert received	Investigate or block traffic
7	End	No more packets or analysis complete	Process stops

💡 Analysis ends when all packets are processed or a stop condition is met

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
Packets	None	Captured all packets	Filtered TCP packets	Inspected packet details	Flagged suspicious packets	Alert generated	Analysis complete
Alerts	None	None	None	None	Suspicious packets found	Alert sent	Alert handled

Key Insights - 3 Insights

Why do we filter packets after capturing them?

Filtering reduces the amount of data to analyze by focusing only on relevant packets, as shown in step 2 of the execution_table.

How do we know which packets are suspicious?

By inspecting packet details and detecting unusual patterns or IPs, as shown in step 4 where suspicious packets are flagged.

What happens after an alert is generated?

The alert is sent to the security team who then investigate or block traffic, as shown in steps 5 and 6.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after step 2?

A Alert sent to security team

B All packets are captured

C Only TCP packets remain

D Suspicious packets flagged

💡 Hint

Check the 'Result/Output' column for step 2 in the execution_table

At which step are suspicious packets flagged?

A Step 4

B Step 3

C Step 5

D Step 6

💡 Hint

Look for the action 'Detect anomalies' in the execution_table

If no suspicious packets are found, which step would likely be skipped?

A Step 4

B Step 5

C Step 6

D Step 2

💡 Hint

Refer to the alert generation step in the execution_table

Concept Snapshot

Network traffic analysis involves:
- Capturing packets from the network
- Filtering to focus on relevant data
- Inspecting packet details for patterns
- Detecting anomalies or threats
- Generating alerts and taking action

Full Transcript

Network traffic analysis is the process of capturing data packets from a network, filtering them to focus on relevant traffic like TCP packets, inspecting their details such as IP addresses and ports, detecting unusual or suspicious patterns, generating alerts for security teams, and taking actions like investigation or blocking. This step-by-step process helps protect networks by identifying threats early.

Practice

1. What is the main purpose of network traffic analysis?

easy

A. To create new network devices

B. To monitor and understand data flow in a network

C. To increase the physical size of a network

D. To replace all network cables

Solution

1. Step 1: Understand the role of network traffic analysis

   Network traffic analysis involves watching data packets moving through a network to understand how the network is used.

2. Step 2: Identify the main goal

   The main goal is to monitor and understand data flow to keep the network safe and efficient.

3. Final Answer:

   To monitor and understand data flow in a network -> Option B

4. Quick Check:

   Network traffic analysis = monitor data flow [OK]

Hint: Think about what watching data packets achieves [OK]

Common Mistakes:

• Confusing analysis with physical network building
• Thinking it creates devices
• Assuming it changes network size

2. Which of the following is a common tool used in network traffic analysis?

easy

A. Wireshark

B. Photoshop

C. Excel

D. WordPress

Solution

1. Step 1: Identify tools related to network traffic

   Wireshark is a well-known tool designed to capture and analyze network packets.

2. Step 2: Eliminate unrelated tools

   Photoshop is for images, Excel for spreadsheets, and WordPress for websites, none analyze network traffic.

3. Final Answer:

   Wireshark -> Option A

4. Quick Check:

   Network analysis tool = Wireshark [OK]

Hint: Pick the tool known for packet capture [OK]

Common Mistakes:

• Choosing software unrelated to networks
• Confusing general software with analysis tools
• Not recognizing Wireshark

3. Consider this simplified network traffic log snippet:
Time: 10:00, Source IP: 192.168.1.5, Destination IP: 10.0.0.2, Protocol: TCP, Size: 1500 bytes
What does this entry tell you?

medium

A. A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00

B. A UDP packet of 1500 bytes was sent from 10.0.0.2 to 192.168.1.5 at 10:00

C. A TCP packet of 1500 bytes was sent from 10.0.0.2 to 192.168.1.5 at 10:00

D. A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 11:00

Solution

1. Step 1: Read the log details carefully

   The log shows a packet sent at 10:00 from source IP 192.168.1.5 to destination IP 10.0.0.2 using TCP protocol with size 1500 bytes.

2. Step 2: Match details with options

   A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 matches all details exactly. Other options have wrong protocol, IP direction, or time.

3. Final Answer:

   A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 -> Option A

4. Quick Check:

   Match log details exactly = A TCP packet of 1500 bytes was sent from 192.168.1.5 to 10.0.0.2 at 10:00 [OK]

Hint: Match source, destination, protocol, and time exactly [OK]

Common Mistakes:

• Mixing up source and destination IPs
• Confusing TCP with UDP
• Misreading the timestamp

4. A network analyst wrote this filter to capture only HTTP traffic:
tcp.port == 80
But it captures no packets. What is the likely error?

medium

A. The filter should be 'tcp.port != 80'

B. The filter should be 'udp.port == 80' instead

C. The filter should be 'tcp.port = 80' with one equal sign

D. The filter should use 'tcp.dstport == 80' or 'tcp.srcport == 80' instead

Solution

1. Step 1: Understand the filter syntax

   In many network tools, 'tcp.port' alone is not a valid filter; you must specify source or destination port.

2. Step 2: Identify correct filter usage

   Using 'tcp.dstport == 80' or 'tcp.srcport == 80' correctly filters HTTP traffic on port 80.

3. Final Answer:

   The filter should use 'tcp.dstport == 80' or 'tcp.srcport == 80' instead -> Option D

4. Quick Check:

   Specify source or destination port for correct filtering [OK]

Hint: Specify src or dst port, not just tcp.port [OK]

Common Mistakes:

• Using single '=' instead of '=='
• Filtering UDP instead of TCP
• Using '!=' which excludes port 80

5. You want to detect unusual spikes in network traffic size over time. Which approach best applies network traffic analysis?

hard

A. Ignore packet sizes and focus on IP addresses only

B. Only capture packets during business hours

C. Capture packets continuously and analyze size trends using graphs

D. Manually check each packet without tools

Solution

1. Step 1: Understand the goal of detecting traffic spikes

   Detecting spikes means watching how packet sizes change over time, requiring continuous data collection.

2. Step 2: Identify the best method

   Using tools to capture packets continuously and graph size trends helps spot unusual spikes effectively.

3. Final Answer:

   Capture packets continuously and analyze size trends using graphs -> Option C

4. Quick Check:

   Continuous capture + trend analysis = detect spikes [OK]

Hint: Use continuous capture and graph size changes [OK]

Common Mistakes:

• Limiting capture times reduces data accuracy
• Ignoring packet size misses spike info
• Manual checking is impractical for large data