analyzing-network-traffic

Analyzing Network Traffic

Packet capture is ground truth the endpoint can lie about but the wire cannot: every connection, DNS lookup, and byte transferred is recorded, whether or not the host's logs survived. The analysis is turning a flat capture into a story — who talked to whom, over what protocol, whether the pattern was human or automated, and what left the network. You are reconstructing intent from frames, not reading a verdict off a tool.

When to Use

• A .pcap / .pcapng capture needs forensic review for intrusion evidence
• A suspected C2 beacon must be confirmed and its interval, jitter, and channel characterized
• Data exfiltration is suspected and you need to size it, time it, and name the destination
• Malware network behaviour must be documented from the traffic it actually emitted
• A Zeek notice.log or Suricata eve.json alert needs to be run down to a verdict
• DNS tunneling, a DGA, or anomalous TLS (odd certs, rare JA3, SNI mismatch) is suspected

When NOT to Use

• Proactively sweeping endpoint, network, cloud, and identity telemetry for undetected compromise — use hunting-threats; this skill dissects one capture, a hunt spans data sources
• Running the wider incident — use responding-to-incidents; traffic analysis is one evidence stream feeding that process
• Detonating a sample to produce the traffic — use analyzing-malware; come here to analyze the pcap it emitted, not to run the binary
• The evidence is cloud control-plane activity, not packets (CloudTrail, VPC flow gaps, API calls) — use investigating-aws-incidents
• Actively testing a live application rather than analyzing a capture of it — use testing-web-applications

Capture and Handling

Get the capture right or every later step inherits the gap. A truncated snaplen or a dropped-packet capture cannot be fixed after the fact.

# Full-frame capture, no name resolution, write to disk (never parse live)
tcpdump -i eth0 -nn -s 0 -w case.pcap
# -s 0 takes full frames; a default snaplen truncates payloads and breaks carving

# Ring buffer for long-running capture: 20 files of 200 MB, oldest recycled
tcpdump -i eth0 -nn -s 0 -w case-%Y%m%d-%H%M%S.pcap -G 3600 -C 200 -W 20

# Capture without dropping under load: raise the kernel buffer, filter tightly
tcpdump -i eth0 -nn -s 0 -B 4096 'not port 22' -w case.pcap
# Confirm drops after: the summary line reports "packets dropped by kernel"