[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-145600-105":59,"doc-detail-145600-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","interpreting-network-traffic-a-network-intrusion-detectors-look","Interpreting Network Traffic - A Network Intrusion Detector’s Look","","Interpreting Network Traffic presents how a network intrusion detection analyst should interpret suspicious TCP/IP events using NIDS or firewall logs, with an emphasis on investigating beyond simple alerts. The discussion explains creative and logical approaches to questions like possible causes, what the system may have missed, and how real traffic differs from textbook assumptions. It stresses understanding the NIDS internals to reduce false positives, using packet-trace views such as TCPDump format, and encourages community sharing of unrecognized traffic.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/interpreting-network-traffic-a-network-intrusion-detectors-look/145600/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/interpreting-network-traffic-a-network-intrusion-detectors-look/145600.png","ImageObject",300,407,{"name":92,"@type":93},"Quinn Holloway","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-27","2026-08-26",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",17,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What does the paper mean by an “event” in network intrusion detection?","Question",{"text":113,"@type":114},"An event is any TCP/IP-based network traffic that prompts the analyst to investigate further. The expectation is that abnormal or malicious suspicion should trigger closer inspection.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Why should analysts not rely only on NIDS alerts?",{"text":118,"@type":114},"NIDS consoles can miss or misunderstand events because they may interpret traffic incorrectly or lack packet-level context. Viewing packet traces at a finer level can clarify what truly happened.",{"name":120,"@type":111,"acceptedAnswer":121},"How can a NIDS report misleading traffic direction or ports?",{"text":122,"@type":114},"If the NIDS is configured to record only certain destination ports, low ports might actually be source ports from another system. The NIDS may then present traffic in a reversed direction.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},145600,1787725672,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":130,"read_time":145},2336474466712,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Interpreting Network Traffic:  \nA Network Intrusion Detector’s Look  \nat Suspicious Events  \nby  \nRichard Bejtlich, TaoSecurity  \n[richard@bejtlich.net](richard@bejtlich.net)  \n[www.bejtlich.net](www.bejtlich.net)  \nv 2.8 14 May 00  \nThe purpose of this paper is to discuss interpretations of selected network traffic events from the viewpoint of a network intrusion detection analyst. (I define an \"event\" as any TCP/IP-based network traffic which prompts an analyst to investigate further. Generally, a suspicion that traffic has an abnormal or malicious character should prompt a closer look.) I assume the analyst has no knowledge of the source of the event outside of the data collected by his network-based intrusion detection system (NIDS) or firewall logs. I do not concentrate on the method by which these events are collected, but I assume it is possible to obtain data in TCPDump format. Using this standard allows a consistent presentation and interpretation of network traffic.  \nI thank Steven Northcutt for writing Network Intrusion Detection: An Analyst’s Handbook. His work prompted me to analyze my own IDS output more closely, resulting in the traces you see today. I must also thank my coworkers for sharing their technical expertise and for reviewing this paper.  \nThe Problem  \nNetwork intrusion detection is part art and part science. When confronted by abnormal network traffic, one must answer several questions:  \n-What could cause the traffic to be generated?  \n-What did the NIDS miss?  \n-How does reality differ from textbooks?  \n-Should I share with the community?  \nSince few people in the network security field are \"experts,\" answering several of these questions requires a combination of creativity and logic. Thinking creatively helps imagine what sort of activity might have generated the traffic seen in his NIDS or firewall logs. Thinking logically assists the understanding of the actions necessary to generate suspicious traffic.  \nWhile the interpretation techniques explained here are pertinent to activity logged by a NIDS or firewall, I approach the subject from the NIDS angle. This my favorite subject, and I present this data with a warning: know the inner workings of your NIDS, or suffer frequent false positives and false conclusions.  \nFor example, perhaps a NIDS records connections only to ports 21, 23, 25, and 80, because you run services on these ports. If the NIDS alerts you to attempted connections to these ports, it does not mean an intruder scanned those ports alone. He may have hit ports 0 to 1023, with the NIDS only seeing four attempted connections. Always wonder \"what did the NIDS miss?\" This question is at the heart of an  \nexcellent paper by Tim Newsham and Tom Ptacek, titled \"Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection,\" available at [http://www.nai.com/media/ps/nai_labs/ids.ps](http://www.nai.com/media/ps/nai_labs/ids.ps) .  \nJonathan Skinner’s summary is also worth perusing: [http://www.nai.com/media/doc/nai_labs/ids-simple.doc](http://www.nai.com/media/doc/nai_labs/ids-simple.doc) .  \nNewsham and Ptacek remind us a NIDS may not be able to reconstruct events properly. From our earlier example, perhaps ports 21, 23, 25 and 80 were not the destination on the host; they could be the source ports of another system sending packets to us. However, being low ports, the NIDS might assume they are destination ports on our host. The NIDS then presents a reversed direction of traffic. (If your NIDS does not make these mistakes often, consider yourself fortunate and a smart selector ofNIDS software!)  \nHaving done network intrusion detection since December 98, I have learned the most interesting activity occurs below the level of detail offered by the NIDS console. Although many NIDS have improved collection, interpretation, and presentation functions, some traffic can best be understood at the packet trace level. Relying solely on the alerts show by the NIDS can lead to missed","cbCaiqnbKrUU4m9g","https://ap.wps.com/l/cbCaiqnbKrUU4m9g","pdf",89053,21,"English","# The Problem\n## How to interpret suspicious events\n## What the NIDS may miss\n## Reconnaissance vs. misinterpretation\n# The Tool\n## TCPDump and consistent traffic capture\n## Windump and Windows ports\n## Building a simple NIDS\n# TCPDump Format","[{\"question\":\"What does the paper mean by an “event” in network intrusion detection?\",\"answer\":\"An event is any TCP/IP-based network traffic that prompts the analyst to investigate further. The expectation is that abnormal or malicious suspicion should trigger closer inspection.\"},{\"question\":\"Why should analysts not rely only on NIDS alerts?\",\"answer\":\"NIDS consoles can miss or misunderstand events because they may interpret traffic incorrectly or lack packet-level context. Viewing packet traces at a finer level can clarify what truly happened.\"},{\"question\":\"How can a NIDS report misleading traffic direction or ports?\",\"answer\":\"If the NIDS is configured to record only certain destination ports, low ports might actually be source ports from another system. The NIDS may then present traffic in a reversed direction.\"}]","Interpreting Network Traffic - A Network Intrusion Detector’s Look | PDF",53]