Chapter 7 — Networks and protocols
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 HTTP and HTTPS"]
N2["7.2 DNS"]
N3["7.3 Email"]
N4["7.4 Proxy logs"]
N5["7.5 Joining host and network"]
N6["7.7 Time"]
N7["Ports and services"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 HTTP and HTTPS"]
N2["7.2 DNS"]
N3["7.3 Email"]
N4["7.4 Proxy logs"]
N5["7.5 Joining host and network"]
N6["7.7 Time"]
N7["Ports and services"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 HTTP and HTTPS]
|
v
[7.2 DNS]
|
v
[7.3 Email]
|
v
[7.4 Proxy logs]
|
v
[7.5 Joining host and network]
|
v
[7.7 Time]
|
v
[Ports and services]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) describe HTTP, DNS and email protocols; (2) read proxy and email logs; (3) relate network evidence to host evidence; (4) state limits of network attribution.
7.1 HTTP and HTTPS
Web requests specify a method (GET, POST), host and path. With HTTPS, content is encrypted, but proxies configured for inspection or logs of host names still show which sites were contacted.
For ws-114, the proxy log shows the host login-portal.example.net and the request methods even though the page content was encrypted. The method matters: a GET usually fetches a page, while a POST sends data to the server. That difference is what lets Leah say that something was submitted to the fake page, without seeing what it was.
7.2 DNS
Before connecting, a host resolves the name to an IP address. DNS logs show which names were looked up and when.
A DNS lookup shows intent to connect, not that a connection succeeded, so Leah pairs DNS records with proxy or firewall logs. Caching also matters: if ws-114 had looked up login-portal.example.net earlier, a second visit might not produce a new query. The absence of a DNS record therefore does not rule out a visit. She notes the DNS server's time zone before merging records with the proxy log.
7.3 Email
Email passes through servers that add Received headers. Reading them from bottom to top traces the path; authentication results (SPF, DKIM, DMARC) show whether the sending domain authorised the message.
Each server adds its Received header at the top, so the oldest hop is at the bottom. The headers nearest the top were added by the university's own servers and are the most trustworthy; lower ones can be forged by the sender. For the ws-114 email, a DMARC failure for a message claiming to be from IT Servicedesk would support the phishing finding, and the delivery time of 09:12 UTC anchors the timeline.
7.4 Proxy logs
The university proxy records time, client host, destination and request. In the ws-114 case, a POST to login-portal.example.net shows data were submitted to the fake page — consistent with credentials being entered.
The phrase "consistent with" is deliberate: the log shows that data were sent, but not what they were. The POST at 09:14:30 came twenty seconds after the GET at 09:14:10, enough time to type a username and password. Whether s.kaur's credentials were then used elsewhere is a separate question answered by logon records.
7.5 Joining host and network
Proxy logs name ws-114; browser history on ws-114 shows the same URL. Two independent sources agreeing strengthens the finding.
The two sources are independent in the sense that matters: one is recorded on the workstation, the other on the proxy, and an attacker controlling ws-114 could not easily alter the proxy log. If they disagreed, for example on the time, the clock offset would be checked first. Agreement at the same second, 09:14:30, once ws-114's times are corrected for its clock running 47 seconds slow, gives confidence that both describe the same event.
7.6 Attribution limits
The proxy identifies the workstation, not the person; shared lab computers make this especially important. Logon records help, but a logged-in account is still not a person.
In a student lab, several people may use ws-114 in a day, and passwords are sometimes shared. A logon by s.kaur shows that the account was used, not who was at the keyboard. Leah's report states the account and the workstation and leaves identification of the person to other evidence, such as door access records or witness statements, which the security office may or may not pursue.
7.7 Time
Proxy and workstation clocks are compared before events are merged.
If the proxy clock is thirty seconds ahead of ws-114, a browser entry at 09:14:30 and a proxy entry at 09:15:00 describe the same moment. Leah records each source's offset against a reference, converts all times to UTC, and notes the precision of each source, since some logs record only whole seconds or minutes. Only then does she place events from different sources on one timeline, with each entry tagged by its source so a reader can see where it came from.
Ports and services
Port numbers suggest services — 443 for HTTPS, 25 for mail transfer — but a service can run on any port. Leah treats ports as hints and checks the protocol actually observed in the logs before naming a service in a report.
Worked example
Leah lines up three records: the email delivered at 09:12 UTC; proxy GET to the fake page at 09:14:10 and POST at 09:14:30; browser history entry at 09:14:30. She writes: "ws-114 requested and then submitted data to login-portal.example.net within two minutes of the email's delivery."
Synthetic case. The logs are invented.
Errors and limits
A POST shows data were sent, not what was sent; content may be unavailable.
Exercises
- EX019 — POST meaning. What does the POST record show and not show? Rubric: 3 = data submitted; content unknown; 2 = partial; 1 = password captured; 0 = none.
- EX020 — Received headers. In what order are Received headers read? Rubric: 3 = bottom to top to trace path; 2 = partial; 1 = top down; 0 = none.
- EX021 — Shared computer. Why does ws-114 being shared matter? Rubric: 3 = workstation not person; needs logon/other evidence; 2 = partial; 1 = no matter; 0 = none.
Synthesis
Protocol logs, read together with host evidence and adjusted for time, show what systems did — not who sat at them.
Continue studying — chapter 07 of 40
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →