[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.5.e
AP Cybersecurity · Securing Networks
Analyzing Logs for Indicators of Compromise
Six network attacks, six different signatures — and four capture fields where the evidence lives.
key ideaEach attack leaves a different signature. Match the anomaly to the mechanism that produces it.
exam-day recap
- An evil twin shows up as SSIDs that look suspiciously similar to a legitimate local SSID.
- Jamming means no device in a physical area can connect, with electromagnetic noise across the wireless range.
- ARP poisoning shows unusual ARP messages, especially duplicate MAC address ARP packets.
- MAC flooding shows an unexpected surge of Ethernet frames carrying many different MAC addresses.
- A smurf attack shows a sudden increase in ICMP requests sent to the network's broadcast address.
- DNS poisoning is the one the CED calls difficult to detect; you infer it from lost traffic rather than observe it directly.
- The four network IoC fields in packet captures are source/destination IP address, port, protocol, and volume & timing.
- An unsolicited ARP reply — one with no request — is the first thing to notice in a poisoning capture.
- When reading a capture, establish what normal looks like first, then find what breaks the pattern.
What to look for
Detection is not one skill. Every network attack in this unit disturbs the network in its own particular way, so each has its own tell-tale. The table below is the whole topic in one place: learn the middle column and the log reading follows.
| Attack | What to scan for | Where you look | Difficulty |
|---|
| Evil twin | SSIDs that look suspiciously similar to a legitimate local SSID | regular wireless SSID scans; signal triangulation to locate and disable the rogue access point | moderate |
| Jamming | no device in a physical area can connect at all; electromagnetic noise across the wireless range | user reports plus an EM/spectrum scan | easy to notice, hard to locate |
| ARP poisoning | unusual ARP messages — especially duplicate MAC address ARP packets | network traffic monitoring; the ARP table on the default gateway | moderate |
| MAC flooding | an unexpected surge of Ethernet frames carrying many different MAC addresses | traffic monitoring; the MAC address table on the switch | moderate |
| DNS poisoning | an abrupt, otherwise inexplicable drop in traffic to the organization's website | DNS records, examined as a candidate cause | difficult |
| Smurf | a sudden increase in ICMP requests sent to the network's broadcast address | traffic monitoring | moderate |
DNS poisoning is the one the CED explicitly calls difficult to detect — you often infer it from an effect (lost traffic) rather than observe it directly.
| Network IoC field | What a suspicious value looks like |
|---|
| source / destination IP address | connections to known-malicious or unexpected foreign addresses |
| port | traffic on a port no business service uses, or a service running on a non-standard port |
| protocol | a protocol that has no reason to appear on that segment |
| volume & timing | large transfers outbound, or steady beaconing at a fixed interval |
Network-based IoCs are most often recovered from packet-capture files. These four fields are where the CED says the indicators live.
Reading the evidence
The same five moves work for every attack in the table — only step 3 changes with the signature you found.Below is a trimmed capture summary from a campus switch. Establish normal first. Read it the way an analyst does: establish what normal looks like first, then find what breaks the pattern.
arp monitor — gateway 10.0.4.1EK 3.5.E.3
# timestamp sender-ip sender-mac note
10:02:11 10.0.4.1 00:1b:44:11:3a:b7 gateway, consistent all week
10:02:12 10.0.4.57 9c:8e:99:04:cf:21 normal host
10:14:03 10.0.4.88 3e:07:aa:52:19:0d normal host
10:41:55 10.0.4.1 3e:07:aa:52:19:0d SECOND mac claiming the gateway IP
10:41:56 10.0.4.1 3e:07:aa:52:19:0d unsolicited ARP reply
10:41:58 10.0.4.57 9c:8e:99:04:cf:21 normal host
line 4Two different MAC addresses now claim 10.0.4.1. A duplicate-MAC ARP packet for the gateway is the classic ARP-poisoning signature.line 5The reply is unsolicited — no host asked. Gratuitous ARP replies are how the attacker keeps the poisoned mapping fresh.cross-checkThe rogue MAC 3e:07:aa:52:19:0d also appears at 10:14 as host 10.0.4.88 — that is the machine to isolate.confirmCheck the ARP table on the default gateway itself; if it disagrees with the switch's view, the poisoning has taken hold.
Worked analysis
EX 1
Identify the attack from the capture
Using the ARP monitor output above, name the attack, justify it from the evidence, and state your next two actions.
1
Establish the baseline
For most of the week 10.0.4.1 maps to a single MAC, 00:1b:44:11:3a:b7. One IP, one MAC — that is normal.
2
Find the break
At 10:41 a second MAC, 3e:07:aa:52:19:0d, begins claiming the same gateway IP. That is a duplicate-MAC ARP packet.
3
Name the attack
Unsolicited ARP replies binding the gateway's IP to an attacker MAC is ARP poisoning. Traffic bound for the gateway will be delivered to the attacker instead — a man-in-the-middle position.
4
Confirm before acting
Check the ARP table on the default gateway. If it shows the rogue MAC for a host it should not, the poisoning is live rather than a transient duplicate.
5
Act
Isolate host 10.0.4.88, which used that MAC earlier, and report the indicator (the rogue MAC and the affected IP) so other segments can be checked.
EX 2
Two attacks, similar symptom, different evidence
Users in one wing report they cannot connect to Wi-Fi. Users elsewhere are fine. Distinguish jamming from an evil twin, and say what you would scan for in each case.
1
Note what the symptom alone tells you
“Cannot connect in one physical area” fits both: jamming denies service in a radius, and an evil twin can pull clients off the real access point.
2
Test for jamming
Jamming means no wireless device in that space can connect to any network. Scan for electromagnetic noise across the wireless range; a raised noise floor with no valid frames confirms it.
3
Test for an evil twin
An evil twin means devices do connect — just to the wrong access point. Scan for SSIDs resembling the legitimate one (extra characters, swapped letters, an unexpected duplicate).
4
Locate the source
For an evil twin, use signal triangulation to find the rogue access point and disable it. Jamming is located the same way but the device is a transmitter, not an AP.
5
The discriminator
Connection refused everywhere points to jamming; connection succeeding to the wrong SSID points to an evil twin. Ask which one users are actually experiencing before you scan.
EX 3
Infer the attack you cannot see directly
Traffic to the organization's public website drops by 80% overnight. The web server is healthy, its logs show few requests arriving, and nothing changed on the network. What do you suspect, and why is this case unusual?
1
Locate where the traffic is lost
The server is fine and requests are simply not arriving, so the failure is upstream of the server — in how clients resolve the name.
2
Name the candidate
DNS poisoning: corrupted DNS records send visitors to an attacker's address instead of the real one, so legitimate traffic never reaches the server.
3
Explain the difficulty
The CED flags DNS poisoning as hard to detect precisely because there is no anomalous traffic on your network to observe. You infer it from a missing effect.
4
Investigate
Examine the DNS records for the domain and compare the authoritative values against what external resolvers return.
5
Contrast with a smurf attack
A smurf attack is the opposite shape: it shows up as a sudden surge in ICMP requests to the broadcast address — loud and immediately visible in traffic monitoring, where DNS poisoning is silent.
Check yourself
Which two log observations together indicate ARP poisoning?
Show answer
Duplicate MAC address ARP packets — two MACs claiming the same IP, typically the gateway's — and unsolicited/unusual ARP replies. Confirm by checking the ARP table on the default gateway.
How do you tell a MAC flooding attack from ordinary busy traffic?
Show answer
MAC flooding shows an unexpected surge of Ethernet frames with many different MAC addresses, aimed at overflowing the switch's MAC address table. Check that table on the switch: it will be full of addresses that do not correspond to real hosts.
What single scan distinguishes jamming from an evil twin?
Show answer
A scan for electromagnetic noise in the wireless range. Jamming raises the noise floor and blocks all connections; an evil twin produces no unusual EM noise but does produce a look-alike SSID.
Why is DNS poisoning described as difficult to detect?
Show answer
It leaves no anomalous traffic on the defender's own network. It is usually inferred indirectly — for example from an abrupt, otherwise inexplicable drop in traffic to the organization's website — which then prompts examining DNS records.
What is the signature of a smurf attack?
Show answer
A sudden increase in ICMP requests sent to the network's broadcast address, which multiplies each request into replies from every host.
Name four packet-capture fields where network-based IoCs are found.
Show answer
Source IP address, destination IP address, port, and protocol — for example a connection to a known-malicious IP, or a service appearing on a port it should never use.
You find a rogue access point broadcasting a look-alike SSID. What technique locates it physically?
Show answer
Signal triangulation, which uses signal strength from multiple points to pinpoint the broadcasting device so it can be disabled.