Overview
The ultimate goal of packet analysis in security is recognizing anomalies — traffic that deviates from normal and may signal a problem or an attack. This capstone lesson brings the module's skills together into the practice of spotting the unusual.
Learning objectives
- Explain why a baseline of "normal" is essential to anomaly detection.
- Identify common categories of network anomalies.
- Combine capture, filtering, and protocol knowledge to investigate.
Core concept
Anomaly recognition is detecting traffic that departs from expected patterns. It rests on knowing what normal looks like — a baseline. Without a baseline, you cannot tell unusual from routine. Common anomaly categories:
- Volume anomalies — sudden spikes or unusual data volumes (possible DoS or exfiltration).
- Unexpected destinations/ports — traffic to strange IPs, domains, or non-standard ports.
- Protocol anomalies — malformed packets, or a protocol behaving oddly (e.g. incomplete handshakes).
- Timing/pattern anomalies — regular beaconing intervals, off-hours activity.
- Unusual sources — a host suddenly scanning or contacting many peers.
How it works
An analyst compares observed traffic against the baseline using the module's tools: capture at the right point, filter to the traffic of interest, follow streams to understand conversations, and read DNS/HTTP for intent. Anomalies rarely prove an attack by themselves — they are leads to investigate. The workflow is: notice a deviation, form a hypothesis, filter and drill in to confirm or dismiss it, and correlate with other evidence.
Practical example
Baseline: a workstation normally talks to internal servers and a handful of known sites during business hours. One night, a capture shows it scanning many internal IPs on port 445 and sending large volumes outbound to an unfamiliar external address. Each deviation — off-hours activity, internal scanning, a strange destination, high outbound volume — is an anomaly; together they strongly suggest a compromised host performing lateral movement and exfiltration, warranting immediate response.
Cybersecurity relevance
Anomaly recognition is the heart of network detection, threat hunting, and incident response (and feeds directly into the SOC/Blue Team path). It is how analysts find intrusions that evade signature-based tools. The skill combines everything in this module — protocols, capture, filtering, stream analysis, indicators — into judgment about what is abnormal and worth investigating, always grounded in a solid understanding of normal.
Common mistakes
- Having no baseline, so nothing can be judged abnormal.
- Treating every anomaly as a confirmed attack — anomalies are leads to investigate, not verdicts.
- Looking at one signal in isolation rather than correlating multiple deviations.
Key takeaways
- Anomaly recognition detects deviations from a known baseline of normal traffic — without a baseline, anomalies are invisible.
- Categories include volume, unexpected destinations/ports, protocol, timing/pattern, and unusual-source anomalies.
- It combines capture, filtering, stream analysis, and protocol/indicator knowledge; anomalies are investigative leads to confirm and correlate, not automatic proof of attack.
Check your understanding
- Why is establishing a baseline of normal traffic a prerequisite for recognizing anomalies?
- Give three distinct anomalies that, seen together on one host, would suggest a compromise.