How to tell an attack from normal traffic
To spot an attack, look in the traffic and the logs for two things. First, a pattern known to be bad. Second, behaviour far from normal. The first is a signature. The second is an unusual rate.
Attacks leave marks, and the marks are only useful if somebody reads them.
A small firm's web server logs a thousand lines an hour. One source in them is asking for a file called .env again and again.
By the end of this lesson
Note
I can recognise an attack in traffic and logs.
Key words
| Word | What it means |
|---|---|
| Log | a record of what happened, one line for each event |
| Signature | a known bad pattern to look for |
| Baseline | what normal looks like for this system |
| Rate | how many events happen in a period of time |
| Brute force | trying many passwords against one login |
| False positive | an alert about something harmless |
The cells students fill in are left blank in this preview.
A signature is a known bad pattern
A signature is something an attack is known to contain. A request for /.env asks for a file of secrets. The text ' OR 1=1 in a form is an attempt to trick a database.
Matching a signature is quick and has few false alarms. But it only finds attacks you already know about, and an attacker can change the words slightly.
Worked example: signatures in a web log
| Log line | Pattern | Verdict |
|---|---|---|
| 10:01:02 198.51.100.4 /home | Normal page | Fine |
| 10:01:05 198.51.100.9 /.env | A file of secrets | Alert |
| 10:01:06 198.51.100.9 /admin | A login page nobody advertised | Look closer |
| 10:01:07 198.51.100.9 /login | A login page | Count how often |
The cells students fill in are left blank in this preview.
The one rule
Warning
Send odd requests only inside this lab. It is yours alone and reaches nobody else. Probing a server that is not yours, without written permission, can be a crime under the Computer Misuse Act 1990.
Send three odd requests to the LAN page
sudo ip netns exec gw curl --noproxy '*' -s -m 3 http://10.0.0.2/admin http://10.0.0.2/login http://10.0.0.2/.envShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Find them in the page's log
sudo grep -E ' /(admin|login|\.env)$' /var/log/netlab/lan-web.logShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the page and its log show
The first Run prints lan-web: you are 10.0.0.1 three times. The page answers each request and says which address it saw.
The second Run finds the three paths in the log. Each line holds a time, the address 10.0.0.1 and the path. If you run the first Run again, the log gains three more lines.
The log names the gateway, not a person. Every machine behind a NAT gateway looks like one source.
An unusual rate can show an attack
Many attacks have no special words. They are just too much of something. A brute force attack tries thousands of passwords. A port scan touches many ports in seconds.
To see this, count. Count events for each source, and compare them with a baseline: what normal looks like for this system.
Count requests per source in sample lines
printf '10:00:01 10.0.0.9 /login\n10:00:02 10.0.0.9 /login\n10:00:03 10.0.0.9 /login\n10:00:04 10.0.0.5 /home\n' | awk '{print $2}' | sort | uniq -c | sort -rnShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Counting by source is a short pipeline
The four lines are made-up log lines. awk keeps the second word of each, which is the address. sort puts equal addresses side by side, and uniq -c counts each group.
The last sort -rn puts the biggest count first. The output has two lines: the count 3 beside 10.0.0.9, then 1 beside 10.0.0.5.
Worked example: requests in one minute
| Source | Requests | Different ports | Verdict |
|---|---|---|---|
| 198.51.100.4 | 18 | 1 | Normal, near the baseline of 20 |
| 198.51.100.9 | 400 | 1 | Far too many: brute force or a flood |
| 203.0.113.7 | 30 | 25 | Few requests but many ports: a scan |
| 192.0.2.50 | 22 | 1 | Normal |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think a high rate from one address is always an attack. A whole office behind one NAT gateway shares a single address, and a backup job is noisy by design. Check the baseline and the pattern before you call it an attack. A false positive wastes time and hides real alerts.
Going further: write down a rule
Choose one thing from the lesson: a signature, a high rate from one source, or many ports from one source.
Write a rule for it in one sentence, with a number. Then say one harmless thing that would trigger it, and how you would tell it apart.