Detecting Anomalies

Detecting anomalies means spotting traffic that deviates from a network's baseline. You cannot recognize abnormal until you know normal.

This lesson covers the common patterns that betray malicious activity.

A port scan appears as one source touching many ports on a host, often with SYN packets that get RST replies.

A burst of SYNs across sequential ports from a single IP is a classic signature.

Malware often beacons: it contacts a command-and-control server at regular intervals. The tell is periodic, similarly sized connections to the same destination.

Look for clockwork timing that human browsing never has.

DNS tunneling smuggles data inside DNS queries. The signature is many long, random-looking subdomains under one domain.

High query volume to a single domain with encoded labels is suspicious.

Watch for protocols on the wrong ports: SSH on 443, or raw TCP where you expect HTTPS.

Attackers hide traffic on common ports to slip past firewalls. Wireshark's protocol detection helps spot the mismatch.

A workstation suddenly sending gigabytes outbound can indicate data exfiltration.

Use Statistics Conversations and sort by bytes to find hosts pushing unusual volumes to external IPs.

In HTTP, odd or empty User-Agent strings can flag automated tools or malware that did not bother to disguise itself.

Filter for unusual agents to surface scripted clients.

Many RST packets or repeated SYNs without completion can indicate scanning, brute forcing, or a denial-of-service attempt.

A spike in half-open connections is worth investigating.

On local networks, watch for ARP anomalies: two IPs claiming the same MAC, or rapid ARP replies. These suggest man-in-the-middle or ARP spoofing.

Wireshark flags duplicate-address ARP automatically.

A single odd packet rarely proves an attack. Build confidence by correlating multiple indicators across time and hosts.

One beacon plus a known-bad domain plus a large transfer is a strong case; any one alone is weak.

Beyond Wireshark, tools like Zeek and Suricata turn raw packets into structured logs and alerts at scale.

They automate much of the anomaly detection you would otherwise do by hand.

Test your understanding of anomaly detection.

You learned to detect anomalies in traffic.

• Port scans: one source, many ports.
• Beaconing: regular timed C2 connections.
• DNS tunneling: long random subdomains.
• Watch wrong-port protocols, large outbound transfers, RST storms, ARP spoofing.
• Correlate multiple indicators; use Zeek and Suricata at scale.

Next you will extract files and credentials from captures.