Course 46 - CompTIA Cybersecurity Analyst | Episode 22: Tools, Traffic Analysis, and Threat Detection

Episode OverviewThis episode explores how security and network teams monitor enterprise traffic, collect network telemetry, analyze communications, and identify anomalies that may indicate security incidents.The discussion begins with passive and active monitoring techniques, covering flow technologies such as NetFlow, sFlow, and jFlow, as well as RMON statistics and SNMP-based device management. It then examines practical monitoring tools, including Wireshark and NetFlow analysis platforms, before moving into the detection of suspicious traffic patterns such as beaconing, unusual bandwidth consumption, connection failures, and unexpected network communications.The episode emphasizes the importance of establishing reliable traffic baselines and correlating multiple sources of telemetry rather than treating a single unusual observation as proof of malicious activity.Key Topics Covered1. Network Telemetry and Flow DataNetwork telemetry provides visibility into how systems communicate without necessarily requiring inspection of every packet.NetFlow, sFlow, and jFlowFlow technologies can provide metadata about network conversations, including information such as: - Source and destination addresses - Source and destination ports - Transport protocols - Interface information - Traffic volume - Packet counts - Flow duration - Timing information These technologies allow teams to understand traffic patterns and utilization across network infrastructure while generally requiring less storage and processing than full packet capture.Different vendors and platforms implement flow technologies differently, so available fields and collection methods depend on the specific implementation.2. RMON and Network StatisticsRemote Monitoring (RMON) provides mechanisms for collecting and analyzing network statistics.RMON-capable probes or agents can collect information across multiple layers of network activity and make statistics available through management systems.This can provide visibility into: - Interface utilization - Packet statistics - Errors - Broadcast activity - Traffic patterns - Network performance Collected information can be exposed through management information structures and integrated into network-management platforms.3. Secure SNMP ManagementSNMP is widely used for monitoring and managing network infrastructure.However, older SNMP versions can provide inadequate protection for management traffic.SNMPv3 adds security capabilities including: - Authentication - Message integrity - Privacy through encryption, depending on the configured security level Organizations should use appropriately secured SNMPv3 configurations where supported rather than relying on insecure legacy management configurations.4. Passive vs. Active MonitoringNetwork monitoring can broadly be divided into passive and active approaches.Passive MonitoringPassive monitoring observes existing network activity without deliberately generating traffic toward the monitored endpoint.Examples include: - NetFlow - sFlow - Packet capture - RMON - Log collection Passive telemetry is particularly useful for understanding normal traffic behavior and identifying anomalies without actively probing systems.Active MonitoringActive monitoring directly interacts with systems or endpoints to determine their current state.Examples can include: - Availability checks - Service monitoring - Synthetic transactions - Direct management queries - Performance tests Active monitoring can provide information that passive telemetry cannot, but it introduces additional traffic and must be configured appropriately.5. Log CorrelationIndividual systems often provide only a partial view of an incident.Log correlation combines information from multiple sources to provide a broader understanding of network and system activity.Potential sources include: - Firewalls - Routers - Switches - Servers - Authentication systems - Endpoint security platforms - DNS servers - Applications - IDS/IPS systems Correlating timestamps, addresses, usernames, ports, and other identifiers can help analysts reconstruct events and identify relationships that may not be visible from a single log source.6. Wireshark and Packet AnalysisWireshark provides detailed packet-level visibility.Unlike flow records, which primarily describe communication metadata, packet captures can expose protocol details and, where traffic is not encrypted or is otherwise available for inspection, portions of the actual communication contents.Analysts can use packet analysis to investigate: - Protocol behavior - Connection establishment - DNS queries - HTTP activity - TCP retransmissions - Network errors - Suspicious communication patterns - Unexpected protocols Packet captures can generate very large amounts of data, so analysts often combine flow information with targeted packet analysis rather than capturing everything indefinitely.7. NetFlow Visualization and Traffic AnalysisNetwork-flow analysis platforms can turn raw flow records into visual representations of network behavior.Tools such as SolarWinds NetFlow Traffic Analyzer can help analysts identify: - Highest-bandwidth endpoints - Major traffic sources and destinations - Top applications or protocols - Interface utilization - Traffic trends - Unexpected communication patterns Visualization can help analysts move from large quantities of telemetry to specific systems or conversations that require investigation.8. Detecting Network BeaconingBeaconing refers to repeated communication between a system and a remote destination at regular or semi-regular intervals.Malware may use periodic outbound communication to maintain contact with command-and-control infrastructure.Potential indicators include: - Repeated connections to the same destination - Similar connection intervals - Consistent packet sizes or traffic patterns - Repeated DNS resolution - Communications occurring during unusual hours - Connections to suspicious or previously unseen destinations Regular periodic traffic is not automatically malicious. Legitimate applications, monitoring systems, update services, and cloud platforms can also generate recurring communications.Analysts should therefore combine timing patterns with destination reputation, process information, DNS activity, endpoint telemetry, and other evidence.9. Unusual Bandwidth ConsumptionSudden changes in bandwidth utilization can indicate a range of conditions.Possible explanations include: - Legitimate backups - Software updates - Large data transfers - Streaming or business applications - Misconfiguration - Network loops - Data exfiltration - Malware activity An analyst should compare the traffic against established baselines and investigate the source, destination, protocol, timing, and volume before determining its significance.10. Link and Connection FailuresUnexpected changes in network utilization can also result from infrastructure failures.Potential causes include: - Hardware failure - Interface errors - Cable or transceiver problems - Routing issues - Configuration changes - Network congestion - Denial-of-service activity A sudden drop in traffic is therefore not necessarily a security incident. Correlating network telemetry with device health, interface statistics, logs, and security alerts helps distinguish infrastructure problems from malicious activity.11. Unexpected and Unauthorized TrafficUnexpected protocols, destinations, or geographic connections can provide useful investigation leads.Examples include: - A server communicating through an unusual protocol - An endpoint contacting a previously unseen external destination - Unexpected international connections - Unauthorized peer-to-peer communication - Internal systems communicating directly with the Internet when they normally should not Detection becomes significantly more effective when organizations establish network traffic baselines describing what normal communication looks like.Baseline-Driven DetectionA useful workflow is: - Establish normal traffic patterns. - Define expected protocols and destinations. - Monitor deviations. - Apply detection and heuristic rules. - Correlate with endpoint and security telemetry. - Investigate suspicious deviations. - Validate whether the activity is legitimate or malicious. 12. Protocol Analysis and InvestigationProtocol analysis helps analysts determine whether traffic is consistent with expected application behavior.Investigation may examine: - Protocol type - Port usage - Connection frequency - Packet characteristics - Session duration< You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy