Reading Network Evidence: Flows vs Full Packets
What is it?
Network evidence comes in two depths. A flow record is metadata about a conversation — who talked to whom, when, over which port, and how much — without the content. A full packet capture (PCAP) adds the payload itself. Most Tier-2 work is done on flows, because they are cheap to keep and, crucially, survive encryption.
Why it matters
In Module 3 you read the host; but the host talks to a network, and half of every modern intrusion — the command-and-control, the exfiltration — happens on the wire. Attackers encrypt their traffic to defeat content inspection, so the analyst who can only read payload is blind. The analyst who reads flows still sees the behaviour, because behaviour is not encrypted.
Where you see it
Flows live in NetFlow/IPFIX records from firewalls and routers, and in proxy and DNS logs. PCAP lives where a sensor was told to capture full packets — rarer, heavier, usually kept only briefly or for specific segments. The SIEM indexes flows so you can pivot a host to every conversation it had.
What normal looks like
Normal traffic is varied and explainable: a browser pulling assets of different sizes at irregular times from a named CDN, an update client checking in hourly with a vendor over a valid certificate, mail flowing to the mail server. Diversity of size and timing, to known destinations, is the signature of the everyday.
What suspicious looks like
Suspicion is a conversation whose shape is too regular or too odd to be human or ordinary software: a small, identical payload leaving on a fixed interval, a large one-shot transfer to a destination nobody recognises, or a burst of DNS queries no application explains. The metadata — timing, size, destination — carries the signal even when the content is sealed.
How analysts investigate
Start from a host or a suspicious destination, pull its flows, and read the shape: the interval between connections, the size and regularity of the bytes, the reputation of the destination. Reach for PCAP only when the flow shape raises a question the payload could answer — and remember most answers are already in the metadata.
Common beginner mistakes
- Believing that because traffic is encrypted, nothing can be learned from it — the metadata is not encrypted.
- Judging a connection by the port number alone — attackers hide on 443 exactly because it looks normal.
- Demanding full PCAP for every case when the flow metadata already answers the question.
What you will be able to do
- Read a flow record for the four facts it carries: who, when, how much, where to.
- Explain what encryption hides and what it leaves in plain view.
- Decide when a flow answers the question and PCAP is unnecessary.
The endpoint told you a payload ran and reached out. Now you follow it onto the wire. The first decision is depth: a flow record gives you the conversation's shape without its words, and that shape — timing, size, destination — is usually all you need, and all you can get once traffic is encrypted.
| Depth | Gives you | Survives encryption? |
|---|---|---|
| Flow (NetFlow) | Who, when, how much, to where | Yes |
| Full packet (PCAP) | The payload content too | No (content is encrypted) |
Step by step for a flow: (1) fix the entity — a host or a destination; (2) pull its flows for the window; (3) read the timing between connections; (4) read the size and its regularity; (5) check the destination's reputation. Only if a question remains that content could settle do you reach for PCAP.
Worked example — which flow is not software?
dst=cdn.jsdelivr.net interval=varied bytes=1.1 MB varied cert=valid CA
dst=45.9.148.200 interval=60s bytes=18 KB identical cert=self-signedThe answer: the second. The first is a browser or updater pulling varied content from a named CDN over a valid certificate — the diversity of size and timing is the signature of ordinary software. The second sends a small, identical payload every 60 seconds to a raw IP with a self-signed certificate: machine-regular, content-free, to an unrecognised destination. You never saw a byte of payload, yet the shape alone identifies command-and-control. Encryption hid the content; it could not hide the behaviour.
Recap
- Flows give the shape of a conversation — who, when, how much, where — and survive encryption.
- Encryption hides content, never behaviour; the metadata carries the signal.
- Judge a connection by timing, size and destination — not by its port.
Sign in to save your progress on the server.