In this simulation, you will analyze network packet captures to understand protocol headers. You will learn to distinguish between Transport layer (TCP) and Network layer (IP) fields to better identify spoofing, pinpoint anomaly sources, and write accurate IDS/firewall rules.

CND (312-38) Network Defense Simulation

Network Scenario

You are a Level 2 SOC Analyst investigating a spike in blocked connections hitting the external firewall interface. The firewall is correctly dropping the traffic, but you need to analyze a raw packet capture (PCAP) of the dropped packets to determine if the attacker is conducting a targeted SYN flood or utilizing spoofed IP addresses. To investigate efficiently, you must accurately extract and differentiate fields across the OSI layers within the packet headers.

The incident context includes:

Traffic & Logs

[PCAP] Frame 142: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) [L3] Internet Protocol Version 4, Src: 192.168.100.45, Dst: 10.0.5.100 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Time to Live: 64 Protocol: TCP (6) Source Address: 192.168.100.45 Destination Address: 10.0.5.100 [L4] Transmission Control Protocol, Src Port: 44342, Dst Port: 443, Seq: 0, Len: 0 Source Port: 44342 Destination Port: 443 Sequence Number: 0 (relative sequence number) Acknowledgment Number: 0 Flags: 0x002 (SYN) Window size value: 64240 Checksum: 0x2e1a [unverified]

Question

Which field is not included in the TCP header?

Think about the OSI model. Which layer is responsible for logical routing (IP) versus end-to-end communication and port delivery (TCP)?

Expert Analysis

1. What is happening in the network: An external host is attempting to initiate a TCP connection (SYN flag set) to your internal web server over port 443. The firewall captured this initial packet. To analyze it, we must parse both the Layer 3 (IP) and Layer 4 (TCP) headers.

2. Identify attack or behavior: During DoS/DDoS investigations (like SYN floods), attackers frequently spoof the Source IP address to hide their origin or to cause backscatter. However, they must maintain valid TCP header fields (Ports, Sequence numbers) to bypass stateless packet filters. Distinguishing between these layers is fundamental for network defense.

3. Why "D" is Correct: The Source IP address is located in the Internet Protocol (IP) header, which operates at Layer 3 (Network Layer) of the OSI model. The TCP header (Layer 4) sits inside the IP payload and is completely unaware of IP addresses; it only cares about Ports, Sequence/Ack numbers, and Flags.

4. Why others are wrong:

  • Acknowledgment number: Found in the TCP header. Used to confirm receipt of data bytes.
  • Sequence number: Found in the TCP header. Used for ordering and reassembling data segments.
  • Source port: Found in the TCP header. Identifies the originating application process on the sender's machine.

5. Defensive Action: When writing Snort/Suricata rules or firewall Access Control Lists (ACLs), you must target the correct header. For example, to block a specific subnet, you apply a Layer 3 rule (IP). To block a specific application service, you apply a Layer 4 rule (TCP/UDP Port). Misunderstanding which field belongs to which header will result in malformed or ineffective defensive rules.

Mini Lesson Decoupling OSI Layers

Layer 3 (Network - IP Header): Handles "Where is this going?" -> Source IP, Destination IP, TTL, Protocol type.

Layer 4 (Transport - TCP Header): Handles "How does the application receive this?" -> Source Port, Destination Port, Sequence Number, Acknowledgment Number, Control Flags (SYN, ACK, FIN, RST, PSH, URG), Window Size.

Explore more CND simulations