Network Intrusion Analysis. This is the skill that separates a boring network report from a real security alert. If you work in cybersecurity, you absolutely must be able to look at raw network traffic and tell the difference between a normal web request and an attacker trying to break in — and that is the core skill tested in exam objective 4.2 of the 200-201.
Jump to a section
A simple way to picture Network Intrusion Analysis
A hotel night auditor is the real-world role at the centre of this scene. Every evening, a busy hotel processes hundreds of guest check-ins, key card swipes, minibar charges, and phone calls. The night auditor’s job is not to greet guests — that happens during the day. Instead, they sit alone in the back office, reviewing a log of every single door opening, every payment attempt, every key card that didn’t work. They compare each entry against the hotel’s normal patterns. A guest unlocking their own room at 9 pm is expected. A guest trying to open five different doors on the same floor at 3 am is a problem. That anomaly gets flagged and escalated to security.
Now imagine a fraudster checks in using a stolen credit card. During the day, the busy front desk misses the red flags. But the night auditor sees the payment system log shows three failed attempts before success — and that the guest’s home address doesn’t match the billing postcode. They also notice that within ten minutes of check-in, the guest’s key card was used to enter a maintenance closet, a storage room, and the staff-only basement. None of those doors should ever be opened by a regular guest. The auditor doesn’t need to chase the person physically — they just follow the digital breadcrumbs in the log files, spot the unusual sequence, and alert the security team. This is exactly what a network intrusion analyst does: they sit in a security operations centre, reviewing traffic logs and data flows, looking for the one door opening that shouldn’t happen.
Network intrusion analysis is the process of examining network traffic data to find evidence of unauthorised access, malicious activity, or policy violations. Think of it as reading the security camera footage of your entire digital building. Every time a device sends a message to another device on a network, that message is called a packet. A packet is a small chunk of data wrapped with addressing information — like a letter in an envelope. The envelope shows who sent it, who should receive it, and what kind of data is inside.
When you study network traffic for intrusions, you typically work with two main sources: packet captures (often called PCAPs) and logs. A PCAP is a recording of all the raw packets that travelled across a specific part of the network during a certain period. It's like having a video recording of every conversation. A log, on the other hand, is a text-based record that summarises events. For example, a firewall generates a log entry every time it allows or blocks a connection. A web server logs every HTTP request it receives. Both PCAPs and logs are critical for intrusion analysis.
Why does this matter? Because attackers rarely break in with a single, loud action. Modern cyber attacks are quiet and gradual. An attacker might first scan your network to find which devices are alive — this is called reconnaissance. Then they might try to exploit a vulnerability in a web application. Then they move sideways inside your network to find valuable data. Each of these steps leaves traces in the network traffic. Your job as an analyst is to connect those traces into a story.
The process of network intrusion analysis typically follows a framework. One common framework is the Cyber Kill Chain, developed by Lockheed Martin. It breaks an attack into seven stages:
Reconnaissance: The attacker probes the network for information, like open ports or running services.
Weaponisation: The attacker prepares the exploit, often combining a vulnerability with a payload.
Delivery: The attacker transmits the weapon to the target, often via a phishing email or a malicious file.
Exploitation: The attacker triggers the vulnerability, gaining a foothold on the system.
Installation: The attacker installs a backdoor or malware to maintain access.
Command and Control (C2): The attacker establishes a channel to remotely control the compromised machine.
Actions on Objectives: The attacker steals data, encrypts files for ransom, or causes damage.
Each stage has specific network signatures. For example, reconnaissance often produces a high volume of packets to many different ports on a single target. That looks like a lot of connection attempts that all fail quickly. Command and control traffic often uses unusual protocols or communicates with an IP address in a country where your organisation has no business.
A related concept is the Diamond Model of Intrusion Analysis. It frames every intrusion event as four interconnected elements: the adversary (who), the capability (what tool or technique), the infrastructure (which IP addresses, domain names, or servers), and the victim (the target). Analysts use this model to track patterns and attribute attacks to specific groups.
To perform analysis, you use tools like Wireshark (for PCAPs) or a Security Information and Event Management (SIEM) system (for logs). A SIEM aggregates logs from many sources and applies rules to alert on suspicious activity. You also use intrusion detection systems (IDS) and intrusion prevention systems (IPS). An IDS monitors traffic and sends alerts when it matches a known attack signature. An IPS does the same but can also actively block the malicious traffic.
A key distinction is between signature-based and anomaly-based detection. Signature-based detection looks for exact matches against a database of known malicious patterns — like a wanted-poster list. It is very accurate for known attacks but cannot detect new ones. Anomaly-based detection builds a baseline of normal behaviour and flags anything that deviates significantly — like a sudden spike in outbound traffic at 3 am. This can catch zero-day attacks but generates more false alarms.
Finally, remember the concept of North-South vs East-West traffic. North-South traffic moves between your internal network and the internet. East-West traffic moves between devices inside your network. Attackers often enter via North-South but then move laterally using East-West traffic. Analysing East-West traffic is crucial for detecting an attacker who has already breached your perimeter.
Collect the Data
You start with raw data sources: packet captures from a network tap or span port, and logs from firewalls, servers, and endpoints. You need a reliable baseline of normal traffic to compare against. This step sets the foundation — without good data, your analysis is useless.
Filter and Normalise the Data
Not all traffic is relevant. You remove known benign traffic (like internal backups) and focus on the alert. You normalise timestamps to a single timezone and format. This reduces noise and makes correlation possible.
Identify the Initial Trigger
You locate the specific event that caused the alert. It might be a failed login, a suspicious file hash, or a connection to a known bad IP. You record the exact source and destination, protocol, and timestamp. This is your anchor point for the investigation.
Determine if the Event Succeeded
You check whether the suspicious action actually succeeded. For example, if it is a login attempt, look for an “access granted” log entry. If it is a file download, check if the full file transfer completed. This separates a failed probe from a successful intrusion.
Pivot to Related Events
Once you confirm success, you look for related events from the same source IP or targeting the same victim. You search for lateral movement, data exfiltration, or command-and-control communication. This reveals the full scope of the attack.
Document and Escalate
You compile your findings into a clear report: what happened, when, what evidence you found, and what the impact is. You escalate to the incident response team with your recommended containment actions. This step closes the analysis loop.
Let me walk you through a real-world scenario that a junior security analyst might face. You work for a medium-sized e-commerce company called “ShopFast”. You are the newest member of a three-person Security Operations Centre (SOC) team. Your main tool is a SIEM called Splunk. Your job is to monitor alerts and investigate suspicious events.
One Tuesday morning, the SIEM fires an alert titled “Multiple Failed SSH Authentication Attempts”. SSH is the Secure Shell protocol used to log into servers remotely. The alert shows that a server in your DMZ (demilitarised zone — a network segment that sits between your internal network and the internet) received 1,200 failed login attempts in a 10-minute window from a single IP address in Russia. Your company does not have any business partners in Russia. Step by step, you do the following:
You open the alert in the SIEM and look at the raw log entries. You confirm the source IP address, the destination server IP, and the timestamps.
You check if any of the attempts were successful. You filter the logs for SSH authentication accepted messages. You find four successful logins from that same Russian IP during the same window. This is a breach.
You immediately escalate to your senior analyst. They tell you to pull the PCAP for that time window. You use a tool like Wireshark to examine the packets from that IP to the server. You see the TCP three-way handshake for the successful connections, followed by SSH encrypted traffic. You cannot see the commands typed inside the SSH session because it is encrypted, but you can see the volume and timing of the data transfer.
Next, you pivot your analysis. You look at the server’s behaviour after the breach. You export logs from the server’s operating system and find that a new user account was created at the same time. You also find that the server started making outbound connections to another IP address in Russia every 60 seconds. This looks like a command-and-control channel.
You correlate this with other data sources. You check the firewall logs and see that the outbound connection was allowed because the firewall rule permits all outbound traffic from the DMZ. A configuration weakness. You note this for the remediation report.
The senior analyst confirms the incident and initiates the incident response process: isolate the server from the network, preserve forensic evidence, and notify management. Your analysis — finding the four successful logins — was the critical piece of evidence that turned a noisy alert into a confirmed intrusion.
This exact scenario happens every day in real SOCs. You are not expected to know everything on day one, but you must be methodical. You must know how to read a log line, how to filter for relevant data, and how to ask the next logical question: “Was the attacker successful?” and “What did they do next?”
The 200-201 exam tests your ability to analyse network traffic and logs to identify intrusions. This is exam objective 4.2, and it is a significant part of the “Network Intrusion Analysis” domain. The exam is heavy on practical scenario-based questions. You will not be asked to configure a firewall. Instead, you will be shown a log excerpt or a PCAP summary and asked to interpret what is happening.
Here is exactly what the exam expects you to know:
Understand the difference between PCAPs and logs. The exam will present a snippet of data and ask “is this a packet capture or a log file?” Packet captures show raw packet headers and payloads, often in hex or ASCII. Logs are structured text, like syslog messages. A common trap: they show you a fragment that looks like a packet but is actually a log entry from an IDS summarising a packet.
Recognise attack types from traffic patterns. For example, a SYN flood attack shows many SYN packets without SYN-ACK replies. A DNS amplification attack shows many small DNS queries with large responses going to a single victim. They might show you a Wireshark screenshot of a TCP conversation and ask you to identify a specific type of scan, such as a SYN scan or a FIN scan.
Identify the stages of an attack. The exam loves the Cyber Kill Chain. They might give you a sequence of logs (port scan, then a web exploit attempt, then a connection to a malicious IP) and ask which two stages of the kill chain are most clearly shown. Common trap: they will list “reconnaissance” and “exploitation”, but also include “weaponisation” as a distractor, even though weaponisation happens before delivery and is not visible in network traffic.
Differentiate between signature-based and anomaly-based detection. You might be asked: “Which type of detection would detect a new, unknown malware variant that has no known signature?” The answer is anomaly-based. Trap: they describe a scenario where the detection system flags a user logging in from a new location, and ask if that is signature-based or anomaly-based. The answer is anomaly-based because it relies on a baseline of normal login locations.
Interpret common protocol behaviours. Know the TCP three-way handshake (SYN, SYN-ACK, ACK). Know that UDP has no handshake. Know the difference between HTTP (port 80) and HTTPS (port 443). A trap question might show a log with high traffic on port 53 (DNS) and ask if that is normal. DNS traffic is usually normal, but a sudden volume of large responses could indicate a DNS amplification attack.
Understand the role of flow data versus full packet capture. The exam might ask: “An analyst needs to see the payload of a malicious file download. Which data source should they use?” The answer is a full PCAP, not NetFlow (which only shows metadata like source/destination IP and port). Trap: they say “the analyst should use the firewall log” — but firewall logs do not contain payload data.
Memorise key definitions: intrusion detection system (IDS) and intrusion prevention system (IPS). IDS monitors and alerts; IPS monitors, alerts, and blocks. Both can be signature-based or anomaly-based. Exam trap: they ask “which system can block a malicious packet in real time without human intervention?” The answer is IPS.
Be able to analyse a simple log line. For example, a web server log entry: “192.168.1.10 - - [12/Nov/2024:10:23:15] ‘GET /admin/login.php HTTP/1.1’ 200 1234”. You should be able to identify the source IP, the timestamp, the HTTP method (GET), the requested resource (/admin/login.php), the response code (200 means success), and the size of the response. Trap: they ask “what does the status code 200 indicate?” Many beginners confuse it with 404. Memorise the common codes: 200 (OK), 404 (not found), 403 (forbidden), 500 (server error).
Network intrusion analysis uses both packet captures (raw traffic data) and logs (summarised events) to detect suspicious activity.
The Cyber Kill Chain breaks an attack into seven stages, and each stage leaves a different signature in network traffic.
Signature-based detection matches known attack patterns, while anomaly-based detection flags deviations from a baseline of normal behaviour.
Always correlate data from multiple sources — a single log is rarely conclusive proof of an intrusion.
North-South traffic (internal to internet) is the entry point; East-West traffic (internal to internal) shows lateral movement once an attacker is inside.
Encrypted traffic can still be analysed using metadata like IP addresses, port numbers, packet sizes, and timing patterns.
A 200 status code in a web server log means the request was successful, not necessarily that it was legitimate.
Intrusion prevention systems (IPS) can block traffic in real time, while intrusion detection systems (IDS) only alert.
These come up on the exam all the time. Here's how to tell them apart.
PCAP (Packet Capture)
Contains raw packet data including payload
Very large file size, stored as .pcap
Requires specialised tools like Wireshark to read
Log File
Contains structured text summaries of events
Smaller file size, stored as plain text or syslog
Can be read with a standard text editor or SIEM
Signature-Based Detection
Matches traffic against a database of known attack patterns
Very low false positive rate for known attacks
Cannot detect new or modified attacks (zero-day)
Anomaly-Based Detection
Builds a baseline of normal behaviour and flags deviations
Higher false positive rate, especially early on
Can detect unknown attacks and zero-day exploits
North-South Traffic
Traffic between your internal network and the internet
Usually passes through firewall and IDS/IPS
Primary focus of perimeter defence
East-West Traffic
Traffic between devices inside your internal network
Often bypasses perimeter security controls
Critical for detecting lateral movement after a breach
IDS (Intrusion Detection System)
Monitors traffic and generates alerts only
Deployed out of band — does not affect traffic flow
Cannot block traffic in real time
IPS (Intrusion Prevention System)
Monitors traffic and can block malicious packets inline
Deployed in line — must handle traffic without delay
Can actively prevent an attack from succeeding
Reconnaissance (Kill Chain Stage)
Attacker probes for open ports, services, or vulnerabilities
Traffic shows many connection attempts, often to multiple ports
No actual compromise occurs yet
Exploitation (Kill Chain Stage)
Attacker triggers the vulnerability to gain access
Traffic shows a single successful exploit attempt
Leads to initial compromise and foothold
HTTP Traffic (Port 80)
Unencrypted — payload is visible in packet captures
Easier to analyse for malicious content
Less common for data exfiltration due to visibility
HTTPS Traffic (Port 443)
Encrypted — payload is hidden from casual inspection
Requires metadata analysis or SSL decryption to inspect
Increasingly used by attackers to hide command and control
Mistake
A single failed login attempt is never worth investigating.
Correct
One failed login is usually noise, but if it targets a sensitive account or comes from a suspicious IP, it can be the first sign of a targeted attack. Context matters.
Beginners learn to ignore “false positives” and then over-correct by ignoring all low-signal events. In reality, analysts tier alerts by context.
Mistake
Encrypted traffic cannot be analysed for intrusions at all.
Correct
Even with encrypted payloads, analysts can examine metadata: source and destination IPs, ports, packet sizes, timing, and certificate details. A spike in encrypted traffic to a known command-and-control IP is still detectable.
Pop culture shows hackers breaking encryption instantly. Beginners think encryption is a total blocker, but most analysis happens at the metadata level.
Mistake
A high volume of traffic always means an attack.
Correct
High traffic can be legitimate, such as a software update push or a marketing event causing a surge in web traffic. The key is to correlate volume with other indicators like unfamiliar source IPs or unusual protocol usage.
Beginners lack experience with normal baselines. Without knowing what “normal” looks like for that network, every spike feels suspicious.
Mistake
All intrusion detection is done by automated tools, not human analysis.
Correct
Automated tools generate alerts, but a human analyst must validate, correlate, and interpret those alerts to confirm an intrusion. False positives and novel attacks require human judgement.
Marketing materials for security tools often claim “AI that stops everything”. Beginners believe the tool is infallible and their job is just to click “acknowledge”.
Mistake
Logs from a single source, like a firewall, are enough to fully investigate an intrusion.
Correct
A thorough investigation requires correlating logs from multiple sources: firewall, server, endpoints, DNS, and DHCP. A firewall log might show blocked traffic, but the server log shows whether the exploit actually worked.
It is easier to focus on one log source. Beginners do not realise each log type shows a different piece of the puzzle, and the full picture requires piecing them together.
Mistake
If a packet contains a known malicious payload, the IDS will always flag it.
Correct
An IDS is only as good as its signature database. If the payload is slightly obfuscated, or if the IDS is misconfigured, it can miss the traffic. Also, IDSs in passive mode do not block anything.
Media portrays IDS as an all-seeing eye. Beginners do not realise signatures must be updated and that evasion techniques exist.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A PCAP is a raw recording of every packet that crossed the network, including the full payload. A log file is a text record that summarises events, like a firewall allowing or blocking a connection. PCAPs give you the entire conversation; logs give you a summary.
Look for a log entry with a success indicator. On Linux systems, an SSH success shows as “Accepted password for user” in the auth.log file. On Windows, a successful logon has Event ID 4624. Any other result (like “Failed password” or event ID 4625) means the attempt failed.
The Cyber Kill Chain is a model that breaks an attack into seven stages. It helps analysts identify where in the attack lifecycle a suspicious event occurred, so they can respond at the most effective stage — for example, disrupting command and control before data exfiltration.
No, a standard IDS only monitors and alerts. To block traffic in real time, you need an intrusion prevention system (IPS), which sits inline with the traffic and can drop malicious packets. Some modern tools combine both functions.
Even if the data inside is encrypted, the metadata is not. You can see which IP addresses are communicating, which ports they use, how much data is transferred, and how often. If a host suddenly sends large amounts of encrypted traffic to a server in an unusual country every 10 seconds, that is suspicious regardless of encryption.
Download Wireshark and capture your own traffic. Start by filtering for a simple web request (HTTP on port 80). Look at the three-way handshake. Then look at the data inside the packet. Practise on public PCAP repositories like those from Wireshark's sample captures or the Contagio malware dump site.
You've finished Network Intrusion Analysis. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?