## Why Analyze Network Traffic?

Network Traffic Analysis (NTA) is looking at the wire. "The Packet Never Lies." Logs can be deleted; Endpoints can be rootkitted to hide processes; but if data was sent, the packets existed.

### The Scope
*   **North/South**: Traffic entering/leaving your network (Internet). Found at the Firewall/Gateway.
*   **East/West**: Traffic moving between internal servers. Found at Core Switches (Internal Taps).

### The Challenge: Encryption
90% of web traffic is HTTPS (TLS encrypted).
*   **Problem**: We can't see the payload. We don't know if the user downloaded a cat picture or malware.
*   **Solution 1**: **SSL Inspection (Decryption)**. A proxy intercepts traffic, decrypts it, inspects it, re-encrypts it. Expensive and raises privacy/legal issues (Banking/Healthcare).
*   **Solution 2**: **Traffic Metadata Analysis**. (JA3).
    *   Even encrypted info has fingerprints.
    *   The "Client Hello" packet in TLS sends specific cipher suites.
    *   A standard Chrome Browser sends one set.
    *   The "Metasploit" hacking tool sends a different set.
    *   JA3 creates a hash of this handshake to identify the *application* even if the *content* is encrypted.

### Use Cases
*   Detecting C2 Beaconing.
*   Finding Data Exfiltration (Large uploads).
*   Spotting scanning activity.