◇ OpenCyber Academy
Technical · Chapter 2 · English

Chapter 2 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and protocols

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 DNS"]
  N2["2.2 HTTPS and the proxy"]
  N3["2.3 SMTP"]
  N4["2.4 Firewall logs"]
  N5["2.5 Address translation"]
  N6["2.6 Protocol abuse"]
  N7["2.7 Time zones"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 DNS"]
  N2["2.2 HTTPS and the proxy"]
  N3["2.3 SMTP"]
  N4["2.4 Firewall logs"]
  N5["2.5 Address translation"]
  N6["2.6 Protocol abuse"]
  N7["2.7 Time zones"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 DNS]
    |
    v
[2.2 HTTPS and the proxy]
    |
    v
[2.3 SMTP]
    |
    v
[2.4 Firewall logs]
    |
    v
[2.5 Address translation]
    |
    v
[2.6 Protocol abuse]
    |
    v
[2.7 Time zones]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) explain DNS, HTTPS and SMTP as sources of intelligence matches; (2) read firewall and proxy log fields; (3) recognise address translation effects; (4) describe Application Layer Protocol abuse.

2.1 DNS

Every connection by name begins with a DNS lookup. Ashgrove's resolvers log client address, name and time. Because students' devices also use them, DNS logs cover devices the college cannot otherwise see.

For CTI, the resolver log is often the first place a domain from ESX can be matched against college activity. Each line ties a client address to a name at a given time, which is enough to show that a device asked for a suspicious domain. It does not show whether a connection followed, so Tomás states that limit in his notes.

2.2 HTTPS and the proxy

Staff web traffic goes through a proxy that records destination name, bytes and category. With encryption, the proxy sees the server name but not page content, unless inspection is enabled — which Ashgrove has not done for privacy and legal reasons.

Without inspection, Tomás can match domains and byte counts from intelligence but cannot see which page was fetched or what was downloaded. The category field helps him spot a rare or newly seen destination among ordinary staff browsing. Students are not covered, because only staff web traffic goes through the proxy, so their activity is checked through DNS instead.

2.3 SMTP

Mail servers exchange messages over SMTP. The gateway records sender, recipient, subject, attachment names and authentication results.

These gateway fields let Tomás match sender domains and attachment names from ESX advisories against messages that actually reached Ashgrove. The authentication results show whether a message claiming to come from the college passed SPF, DKIM and DMARC. Message bodies are not part of his searches, which keeps staff and student correspondence out of intelligence work. Attachment names from the gateway are often the quickest way to match an ESX advisory about a malicious document campaign.

2.4 Firewall logs

Firewall entries show source, destination, port, action and time. They are useful for checking addresses from intelligence feeds.

A firewall match shows only that a college address talked to an address from a feed, not what was sent. Tomás checks whether the feed address belongs to shared hosting before treating the match as meaningful. When the source is a public Wi-Fi address, he must also use the translation log, because the firewall alone cannot name the device. Tomás also notes the action field, since a blocked connection and an allowed one lead to very different follow-up work.

2.5 Address translation

Campus Wi-Fi translates many student devices to a few public addresses. Externally, one address represents thousands of people; internally, the translation log maps back to a device for a given time.

Address translation matters in both directions of sharing with ESX. When Tomás reports an Ashgrove address to ESX, he explains that it is shared Wi-Fi, so other members do not block thousands of students. When he investigates a match, the translation log must be read for the exact time, since the same public address belongs to another device minutes later.

2.6 Protocol abuse

Application Layer Protocol (T1071) describes attackers hiding command traffic in web, DNS or mail protocols so it blends in. Unusual regular connections to a rare domain are a clue worth checking.

At Ashgrove, the DNS and proxy logs are where such regular connections would appear, as repeated lookups or requests at similar intervals. Tomás treats regularity as a reason to look closer, not as proof, because update services also check in on a schedule. He asks the owning team whether the destination is expected before raising an incident ticket.

2.7 Time zones

Logs from cloud suppliers use UTC; campus devices use local time. Convert before correlating.

In the Wi-Fi case, the firewall times had to be converted to UTC before they could be compared with the translation log. A one-hour error during summer time would have pointed to a different laptop, and the wrong student would have been blocked. Tomás writes the zone beside every time in his notes, so reviewers can repeat the conversion. Campus devices change to and from local summer time, so the offset to UTC changes twice a year and must be checked for each date.

Worked example

ESX shares an address used for command traffic. The firewall shows two connections from a public Wi-Fi address. Tomás uses the translation log and the timestamps (converted to UTC) to identify one student laptop. He gives the device identifier to the network team, who block it from Wi-Fi and email the student advice through the help desk; no one inspects the student's personal device.

Synthetic case. The address and device are invented.

Errors and limits

Translation logs are kept briefly; delays lose the mapping.

Exercises

Synthesis

Use DNS, proxy, mail and firewall logs, handle address translation and time zones, and respect limits on personal devices.

Continue studying — chapter 02 of 18

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →