Defensive methodology

Network Traffic Analysis

Reading the network to understand what is really happening: establish what is normal, then spot what deviates from it. NTA supports detection, alert triage and post-incident investigation.

DefensivetcpdumpWiresharktsharkZeek

The approach

The HTB Academy NTA module suggests a five-step loop. It applies to a capture of a few minutes as well as to continuous monitoring.

  1. CollectWhere to capture (TAP, mirror port, host) and what to keep.
  2. Reduce the noiseFilter out known, legitimate traffic to isolate the rest.
  3. AnalyseConversations, protocols, content, timeline.
  4. Detect and alertTurn what you found into a rule or an alert.
  5. Fix and monitorRemediate, then check that the problem does not come back.
First of allYou only spot the abnormal if you know the normal. Document a baseline: usual hosts, expected protocols, volumes, hours.

Capturing with tcpdump

Capture filters use BPF syntax: they decide what gets recorded, so whatever is filtered out is lost.

# List the interfaces
tcpdump -D
# Capture on eth0 without name resolution, into a file
sudo tcpdump -i eth0 -nn -w capture.pcap
# Read a file back, showing the content as ASCII
tcpdump -nn -r capture.pcap -A
# Common BPF filters
tcpdump -nn -r capture.pcap host 10.10.10.5
tcpdump -nn -r capture.pcap 'tcp port 80 or tcp port 443'
tcpdump -nn -r capture.pcap 'src net 10.10.0.0/16 and not port 22'
tcpdump -nn -r capture.pcap 'tcp[tcpflags] & tcp-syn != 0'

Options and BPF / Wireshark equivalents: Network filters cheat sheet.

Analysing with Wireshark

Display filters delete nothing: they hide. Their syntax differs from BPF.

The most useful display filters are in the Network filters cheat sheet, with a revision mode.

Menus to know

  • Statistics → Protocol Hierarchy: protocol breakdown.
  • Statistics → Conversations: who talks to whom, and how much.
  • Statistics → Endpoints: the chattiest hosts.
  • Follow → TCP/HTTP Stream: rebuild a full exchange.
  • File → Export Objects: extract transferred files (HTTP, SMB…).

Suggested reading order

  1. Protocol hierarchy: anything unexpected?
  2. Conversations sorted by volume.
  3. Filter suspicious hosts and follow their streams.
  4. Export objects and record their hashes.

On the command line, tshark accepts the same filters (examples in the cheat sheet).

Spotting anomalies

Classic patterns, what gives them away in the traffic and how to filter for them.

BehaviourWhat you seeFilter idea
Port scanOne source, many SYNs to many ports; many RSTs in return.tcp.flags.syn==1 && tcp.flags.ack==0
ARP spoofingThe same IP announced with two MAC addresses, unsolicited ARP replies.arp.duplicate-address-detected
C2 beaconingOutgoing connections at very regular intervals to the same destination, small volumes.Conversations + timeline (Statistics → I/O Graph)
DNS tunnelLong, random subdomains, many TXT queries, unusual DNS volume.dns && frame.len > 200
ICMP tunnelLarge ICMP packets or packets with non-standard content.icmp && data.len > 64
ExfiltrationUnusually large outgoing volume, often outside business hours.Statistics → Conversations, sorted by bytes
Cleartext credentialsFTP, Telnet, HTTP Basic, SMTP without TLS.ftp || telnet || http.authorization
Lateral movementSMB, RPC or WinRM between workstations, which normally only talk to servers.smb2 || dcerpc || tcp.port==5985
Wi-Fi attack (deauthentication)Bursts of deauthentication frames.wlan.fc.type_subtype == 0x0c

Going further

Zeek

Turns a pcap or live traffic into structured logs (conn.log, dns.log, http.log…). Ideal for searching at scale.

Suricata / Snort

Signature-based IDSs: they alert on known patterns. Rules are easy to read and write.

NetFlow / IPFIX

Flow metadata without content: far smaller, perfect for spotting beacons and exfiltration.

Pcap analysis checklist

  • Note the time span covered and the packet count (Statistics → Capture File Properties)
  • Read the protocol hierarchy
  • Identify the main hosts and conversations
  • Check DNS traffic: rare domains, long or numerous queries
  • Follow HTTP streams and any cleartext credentials
  • Export transferred files and compute their hashes
  • Look for regular connections (beacons) and large outgoing volumes
  • Build a timeline of suspicious events
  • Write down the indicators (IPs, domains, hashes) and the proposed detection rules