## Detecting Malicious Traffic

What does "Bad" look like on the wire?

### 1. Beaconing (Heartbeats)
*   **Regularity**: Every 60 seconds (Delta Time).
*   **Small Size**: Packets are identical in size.
*   **Jitter**: Sophisticated beacons add randomization (60s, 62s, 58s).

### 2. Data Exfiltration
*   **Large Outbound**: Internal IP sending GBs to External IP.
*   **Protocol Misuse**:
    *   **DNS Tunneling**: Huge volume of DNS queries to the same domain.
    *   **ICMP Tunneling**: Ping packets containing data payloads instead of "abcdefg".
*   **Steganography**: Hiding data inside images. (Hard to detect on wire without payload analysis).

### 3. Scanning
*   **Port Scan**: One IP sending SYNs to 1000 ports on one target.
*   **Net Scan**: One IP sending SYNs to Port 445 on 1000 targets.

### 4. Cleartext Credential Leaks
*   **FTP / Telnet / HTTP (Basic Auth)**: Passwords sent in clear text.
*   **Analyst**: "Follow Stream". Search for "Password" or "Pass".