GNFA · Domain 2
Network Protocol Analysis
About 25% of the exam
Capture versus display filters
- Capture filter
- decides what is written
- Display filter
- decides what is shown
- Capture syntax
- packet filter expressions at capture
- Display syntax
- protocol field expressions afterwards
- Coloring rule
- highlights without hiding anything
- Snap length
- bytes kept from each packet
A capture filter throws evidence away permanently; a display filter only hides it from this view
Reading a TCP session
- Handshake
- Data exchange
- Acknowledgments
- Teardown or reset
- Sequence numbers order the byte stream
- Window size shows what the receiver accepts
- Retransmissions suggest loss or injection
- Reset ends the conversation abruptly
- Push with no payload can be a heartbeat
Analysis flags that mislead
- Bad checksums usually mean offload
- Out of order can be capture reordering
- Duplicate acknowledgments follow ordinary loss
- Missing packets may be a dropped mirror
- Truncated packets come from a short snap length
- Verify the sensor before blaming the network
Stream reassembly and carving
- Follow the stream to rebuild the conversation
- Reassemble segments before parsing content
- Export objects from transfer protocols
- Split multipart uploads on their boundaries
- Hash every carved file immediately
- Header and footer carving needs validation
Protocol artifacts to harvest
Web traffic
- Host, path and query parameters
- Agent string identifies tools and scanners
- Referrer reveals how they arrived
- Range headers show chunked retrieval
- Status codes show success or refusal
File sharing
- Share and file names in the tree
- Account used for the session
- Read and write operations per file
- Administrative shares hint at remote execution
Mail and name service
- Envelope sender against the visible sender
- Received chain shows the true path
- Query names and record types
- Response codes reveal failed lookups
Carve the metadata even when the payload is unreadable; names, paths and accounts survive encryption of content
Command line packet work
- Capture with full payload, not truncated
- Rotate into sized files for long captures
- Disable name resolution while capturing
- Extract fields for scripted analysis
- Generate statistics before opening a viewer
- Read from file rather than the wire
Statistics that focus the hunt
- Protocol hierarchy
- what the capture actually contains
- Conversations
- top talkers by bytes
- Endpoints
- per host totals both directions
- Input output graph
- volume over time
- Sequence graph
- one stream plotted against time
- Expert information
- anomalies the dissector noticed
TLS metadata without decryption
- Version and ciphers
- offered and selected parameters
- Name indication
- hostname the client requested
- Certificate
- subject, issuer, validity dates
- Client fingerprint
- hash of the hello parameters
- Server fingerprint
- hash of the chosen response
- Session resumption
- repeat contact between the pair
- Alert messages
- why the handshake failed
What newer TLS hides
- Certificates are encrypted after the server hello
- Encrypted client hello conceals the hostname
- Ephemeral key exchange defeats passive decryption
- Zero round trip data appears before the handshake finishes
- Encrypted name service removes the lookup
- Metadata and timing remain analyzable
Holding the server private key does not decrypt ephemeral sessions; you need logged session keys or an endpoint
Encrypted traffic analysis
Shape and rhythm
- Interval with jitter suggests a beacon
- Uniform small packets suggest tasking
- Long session with lopsided volume suggests tunneling
- Bursts outside working hours deserve review
Identity signals
- Client fingerprint reused across hosts
- Self signed or freshly issued certificate
- Name indication that contradicts the address
- Certificate subject unrelated to the service
Corroboration
- Proxy log adds the user and path
- Endpoint telemetry names the process
- Threat intelligence matches the infrastructure
- Volume matches an observed staging archive
Tunnels and covert channels
- Text records carrying encoded payloads
- Oversized echo requests with data
- Non standard protocol on a common port
- Encrypted shell session with bulk transfer
- Header ordering used as a signal
- Timestamps modulated to carry bits
Packet evidence handling
- Hash the capture file on collection
- Work only from verified copies
- Record the sensor, filter and time source
- Note dropped packet counters
- Keep the original alongside the trimmed capture
- Document any decryption keys used
Key artifacts
- Capture format
- packets plus interface metadata blocks
- Interface statistics
- counts and drops during capture
- Stream index
- identifier for one conversation
- Four tuple
- addresses and ports both ways
- Epoch time
- seconds since the reference date
- Snap length
- bytes retained per packet
Know the order
- Verify capture integrity
- Run the statistics
- Filter to the suspect pair
- Follow and reassemble
- Carve and hash objects
- Corroborate off the wire
Statistics before packets: let the capture tell you where to look before you read a single frame
Reference strip: protocol analysis
Filter thinking
- Capture filters discard permanently
- Display filters hide temporarily
- Coloring rules keep context visible
- Field extraction feeds scripts
Session signals
- Handshake, data, teardown or reset
- Retransmissions and window changes
- Heartbeat pushes with no payload
- Half open attempts across many ports
Content recovery
- Stream reassembly then object export
- Multipart boundary parsing
- Header and footer carving with validation
- Hash every extracted object
Encrypted metadata
- Version, ciphers and extensions
- Name indication and certificate fields
- Client and server fingerprints
- Resumption and alert messages
Capture hygiene
- Full payload, no truncation
- Rotate files and watch drops
- Record filters and time source
- Hash the file, work on copies
Quick exam traps
- Trap: Bad checksums in a capture prove tampering
- Trap: A capture filter can be widened after the fact
- Trap: The server private key decrypts any recorded session
- Trap: Encrypted traffic yields no usable metadata
- Trap: Following one stream reassembles the whole file transfer
- Trap: Name indication always names the real destination
- Trap: Missing packets in the capture mean packets never existed
cybercertprep.com · original revision sheet written from the public body of knowledge