GNFA · Domain 1
Network Architecture & Monitoring
About 25% of the exam
Layers worth naming
- Layer 2
- frames, MAC addresses, switches
- Layer 3
- packets, addresses, routing
- Layer 4
- ports, sessions, reliability
- Layer 6
- encoding, compression, encryption
- Layer 7
- application content and headers
- Encapsulation
- each layer wraps the one above
Say which layer an artifact lives at and half the question answers itself
Address to person
- External address
- Translation record
- Internal address
- Lease to MAC
- Switch port
- Account and device
- Address translation hides the internal host
- Lease logs map address to hardware
- Switch tables map hardware to port
- Port authentication adds the account
- Short leases break naive attribution
Layer 2 and 3 artifacts
- Gratuitous reply
- unsolicited mapping, benign or poisoning
- Requests for empty addresses
- scanning across the segment
- Lease starvation
- one hardware address, many requests
- Relay option
- switch port and location context
- Time to live
- hop count hints at distance
- Fragmentation
- evasion and reassembly ambiguity
DNS as evidence
- Resolver cache proves a recent lookup
- Query type tells you the technique
- Long random labels suggest tunneling
- Many failed lookups suggest generated domains
- Newly registered domains deserve attention
- Encrypted resolvers remove this whole source
Three evidence tiers
Full packet capture
- Complete payload, files can be carved
- Storage hungry, short retention
- Proves exactly what left the network
- Useless when everything is encrypted
Flow records
- Metadata only, tiny on disk
- Months of retrospective beaconing analysis
- Addresses, ports, bytes, timestamps
- Sampling can miss short flows
Logs and telemetry
- Proxy adds the user and full path
- Firewall adds allow and deny decisions
- Sensor logs summarize each session
- Endpoint telemetry ties process to connection
Packets prove content, flows prove pattern over months, logs prove who and what was decided
Sensor placement
- Perimeter sees crossings, not lateral movement
- Internal sensors expose east to west traffic
- Place sensors inside the decryption point
- Virtual switches need their own capture
- Cloud workloads need native flow logging
- Map coverage gaps before the incident
Taps versus mirrors
- Passive tap
- copies the link, cannot drop
- Aggregation tap
- many links into one feed
- Regeneration tap
- one feed to many tools
- Switch mirror
- convenient, drops under load
- Hardware timestamps
- accurate regardless of processor load
- Oversubscription
- silent loss at high rates
Sensor log families
- Connection log
- who talked, how long, how much
- DNS log
- queries, answers, response codes
- HTTP log
- host, path, method, agent
- TLS log
- version, name indication, fingerprints
- Certificate log
- issuer, subject, validity window
- Files log
- extracted objects with hashes
- Notice log
- framework findings worth review
Windows and identity events
- 4624 type 3
- network logon, often share access
- 4624 type 10
- remote interactive session
- 4625
- failed logon with a reason
- 4648
- explicit credentials used for pivot
- 7045
- service installed on the target
- 1102
- security log cleared
- 4768 with legacy cipher
- possible downgrade or roasting
Correlating across sources
Normalize first
- Convert every source to one zone
- Measure and record sensor clock skew
- Match on the address, port and time
- Keep the original timestamps as well
Then pivot
- Connection record to the session log
- Session log to the proxy user
- Proxy user to the endpoint process
- Extracted file hash to intelligence
Unaligned clocks manufacture false causality, so normalize before you claim one event caused another
Retention and readiness
- Tier storage: packets short, flows long
- Rotate captures into fixed size files
- Protect collectors from the monitored network
- Test that logging survives an outage
- Document what is not collected
- Review coverage after every incident
Monitoring blind spots
- Encrypted resolvers hide the lookups
- Encrypted client hello hides the destination
- Peer connections never cross the perimeter
- Personal hotspots bypass the sensors
- Sampled flows lose short conversations
- Container traffic stays inside the node
Rapid recall
- North to south
- traffic crossing the perimeter
- East to west
- traffic between internal hosts
- Flow record
- metadata summary of one conversation
- Active timeout
- long flows exported while running
- Inactive timeout
- flow exported after it stops
- Sampling rate
- one packet in many recorded
- Baseline
- normal pattern that anomalies violate
Know the order
- Confirm sensor coverage
- Normalize every clock
- Start from flows
- Pivot into sensor logs
- Open the packets last
Work from cheap and broad to expensive and narrow, or the capture volume will bury the answer
Reference strip: monitoring foundations
Capture points
- Passive taps on critical links
- Mirror ports for convenience
- Virtual taps inside hypervisors
- Cloud mirroring and flow logs
Evidence tiers
- Full packets for content
- Flow records for patterns
- Sensor logs for structure
- Proxy and firewall for decisions
Protocol tells
- Unsolicited address mappings
- Lease exhaustion attempts
- Long high entropy lookups
- Name indication that contradicts the address
Attribution chain
- Translation record to internal address
- Lease to hardware address
- Switch table to physical port
- Port authentication to the account
Time discipline
- One reference zone everywhere
- Synchronized sensor clocks
- Documented skew per source
- Hardware timestamps at high rates
Quick exam traps
- Trap: A mirror port captures everything a tap would
- Trap: Flow records contain the payload
- Trap: The external address identifies the user
- Trap: Encrypted traffic offers no forensic value
- Trap: Perimeter sensors see lateral movement
- Trap: Sampled flow data proves a short transfer never happened
cybercertprep.com · original revision sheet written from the public body of knowledge