Lab 3 — Reading Network Traffic

Packet

A small unit of data with headers describing where it came from and where it is going.

Three-way handshake

The SYN, SYN-ACK, ACK exchange that opens a TCP connection.

Port scan

Probing many ports on a host to discover which services are listening.

Beaconing

Regular check-in traffic from infected malware to its command-and-control server.

TTL

Time To Live — a hop counter in the IP header that also hints at the sending operating system.

Twelve seconds of traffic from a school laptop, 10.0.5.31. What happened?

1. 11. 09:14:02: 10.0.5.31 → 10.0.5.1 DNS query for 'updates-cdn-eu4.click'. Unusual TLD, never seen before on this network.
2. 22. 09:14:02: DNS response: 185.62.x.x. Hosting provider with no relationship to the school.
3. 33. 09:14:03: TCP SYN → 185.62.x.x:443, SYN-ACK, ACK. Connection opens. TLS, so the payload is unreadable.
4. 44. 09:14:03: 312 bytes out, 96 bytes in. Tiny, uniform exchange — not a web page.
5. 55. 09:15:03 and 09:16:03: Identical exchange, exactly 60 seconds apart, ±0.4s jitter. That regularity is machine-made.
6. 66. 09:16:10: Same host sends SYN to 10.0.5.20 ports 22, 23, 80, 139, 445, 3389 in 900ms. Internal port scan — lateral movement.
7. 77. Verdict: Beaconing plus internal scanning: assume compromise. Isolate the host, preserve the capture, and hunt the domain across all DNS logs.

pythontimes = [0, 60.2, 119.8, 180.3, 240.1, 299.9]
gaps = [round(b - a, 1) for a, b in zip(times, times[1:])]
avg = sum(gaps) / len(gaps)
jitter = max(abs(g - avg) for g in gaps)

print("gaps:", gaps)
print("avg:", round(avg, 1), "jitter:", round(jitter, 1))
if jitter < 2:
    print("ALERT: regular beacon detected")

Humans browse irregularly. A jitter under a couple of seconds across many connections is a strong malware indicator.

Practise the real technique in a fully simulated environment — no live systems, no real data, nothing leaves your browser.