◇ OpenCyber Academy
Technical · Chapter 2 · English

Chapter 2 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and protocols

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 From address to device"]
  N2["2.2 DNS and proxy"]
  N3["2.3 Containment check"]
  N4["2.4 Other hosts"]
  N5["2.6 Time"]
  N6["2.7 Recording"]
  N7["Firewall view"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 From address to device"]
  N2["2.2 DNS and proxy"]
  N3["2.3 Containment check"]
  N4["2.4 Other hosts"]
  N5["2.6 Time"]
  N6["2.7 Recording"]
  N7["Firewall view"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 From address to device]
    |
    v
[2.2 DNS and proxy]
    |
    v
[2.3 Containment check]
    |
    v
[2.4 Other hosts]
    |
    v
[2.6 Time]
    |
    v
[2.7 Recording]
    |
    v
[Firewall view]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) trace a PC's network activity through DHCP, DNS and proxy logs; (2) identify suspicious outbound connections; (3) verify containment worked; (4) avoid over-reading network data.

2.1 From address to device

DHCP logs map WARD4-PC2 to 10.40.4.22 during the morning. Proxy and firewall entries for that address can then be attributed to the PC for that time.

The lease record covers 07:30 to 19:30, which includes the whole incident window on WARD4-PC2. Sana checks the lease rather than assuming a ward PC always keeps the same address, because another device could have held 10.40.4.22 earlier that morning. The same lookup later maps 10.40.9.31 to PHARM-PC3 in the pharmacy at 11:16. Static addresses are the exception, and for those the asset register replaces the lease lookup.

2.2 DNS and proxy

DNS shows WARD4-PC2 resolving update-cdn.example.net at 10:02:45; the proxy shows an HTTPS connection to it, 18 KB sent, 2.1 MB received. The name looks like a software update site but is not one the hospital uses.

The DNS lookup at 10:02:45 comes one second after svch.exe was written, which matches a program contacting its server as soon as it starts. Sana records the name exactly as logged and does not visit it, since browsing to a suspicious domain from the hospital network would itself create traffic. Whether the name is malicious is left to the analyst's report.

2.3 Containment check

After containment at 10:09, the proxy shows no further connections from 10.40.4.22. Sana records this as confirmation that containment worked.

The proxy check only proves that web traffic stopped, so Sana also checks the EDR console for blocked connection attempts after 10:09. Attempts that were refused would show the program still trying to reach its server, which supports containment rather than undermining it. She records both queries, with their time ranges, beside the containment entry in the ticket. Containment at 10:09 came six minutes and fifteen seconds after the first proxy contact at 10:02:45.

2.4 Other hosts

Searching proxy logs for update-cdn.example.net finds one more client: 10.40.9.31 at 11:16, which DHCP maps to PHARM-PC3 in the pharmacy.

The search covers the whole proxy log for the domain rather than only the morning, so earlier contacts from other PCs would also appear. Only one other client is found, which narrows the incident to two ward PCs at that point. PHARM-PC3 becomes the second machine to collect from and is contained at 11:31. The search result is saved with its query so the network team can repeat it if needed.

2.5 Limits

HTTPS hides content; volumes and timing suggest a download, not what it was. Names can be shared by legitimate and malicious services.

The 18 KB sent and 2.1 MB received fit a small request followed by a download, but the same volumes could come from an ordinary software update. Sana writes 'consistent with a download' and leaves the content question to the analyst's report on svch.exe. A name like update-cdn.example.net is chosen to look harmless, so its appearance alone proves nothing either way.

2.6 Time

Proxy and DHCP servers sync to the hospital time server; ward PCs should, but must be checked.

Ward PCs are supposed to synchronise to the same time server, but WARD4-PC2 turned out to be six minutes and twenty seconds slow at collection. Sana therefore compares each PC's clock with a reference before merging its local times with proxy or DHCP times. Server times are trusted only after she confirms they synchronise as configured. The skew affects only times the PC writes itself, such as file-system timestamps and its local event logs. EDR events are different: the EDR server stamps each one with its own synchronised UTC time on receipt, so EDR export and ticket times need no correction.

2.7 Recording

Each finding cites log, time range and query.

A finding written as 'proxy, 10.40.4.22, 10:00–10:30, query by client address' lets Owen rerun the same search and get the same answer. Without the query, a reader cannot tell whether a missing record means no traffic or a search that looked in the wrong place. The same habit applies to negative results, such as the empty firewall search between WARD4-PC2 and the pharmacy. Owen rejects any finding in the ticket that does not name its log, time range and query.

Firewall view

The internal firewall logs connections between hospital segments. Sana checks whether WARD4-PC2 tried to reach other ward PCs or the pharmacy network before containment. It did not, which suggests the spread to PHARM-PC3 happened another way — a clue that later points to the USB stick itself. She records the query, time range and empty result so the negative finding can be checked later.

Worked example

Sana's ticket note: "Proxy: 10.40.4.22 (WARD4-PC2 per DHCP 07:30–19:30) connected to update-cdn.example.net at 10:02:45, received 2.1 MB. No connections after containment (10:09). Same domain contacted by 10.40.9.31 (PHARM-PC3) at 11:16."

Synthetic case. The logs are invented.

Errors and limits

DHCP mappings fail for static addresses; check the asset register for those.

Exercises

Synthesis

Network logs, tied to devices by DHCP and time, scope spread and confirm containment — without revealing encrypted content.

Continue studying — chapter 02 of 18

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →