4.5Protocol headers, artifacts, and regular expressions

Packet headers are a trove of clues for decoding an attack. Knowing what each field means lets you spot a scan type (TCP flags), a suspected C2 (abnormal DNS queries), or spoofing (duplicate ARP) without reading all the content. And extracting the solid traces obtained from analysis—artifacts (IOCs)—and sharing them lets other systems search for and block the same threat. To pick target strings out of massive logs and payloads, regular expressions are indispensable. This section ties together reading major protocol headers, the elements of IOCs, and basic regex as tools for SOC search and surfacing.

4.5.1Major protocol headers and their reading

• L2/L3: Ethernet carries source/destination MAC and EtherType (the first 3 bytes of a MAC, the OUI, hint at the NIC vendor; local segment only). IPv4 has src/dst IP, TTL, protocol number, and flags/fragment (TTL as remaining hops hints at OS/path length). IPv6 has 128-bit addresses, a Next Header, and a Hop Limit. ARP resolves IP<->MAC; multiple MACs for one IP or suspicious gratuitous ARP signals ARP spoofing.
• L4: TCP has src/dst ports, seq/ack, flags (SYN/ACK/FIN/RST/PSH/URG), and a window. The flag pattern indicates a scan type (many SYN-only = SYN scan; frequent RST = closed-port responses). UDP has only src/dst ports and length and is connectionless. ICMP has type/code (echo request/reply, unreachable) and is material for a ping sweep or ICMP tunneling.
• L7: DNS shows domain names in queries/responses; abnormally long random subdomains or many TXT records suggest DNS tunneling/DGA. HTTP (80) exposes Host/URI/User-Agent/method, while HTTPS (443) encrypts the body with TLS, exposing about the SNI only. Email is SMTP (25/587) to send, POP3 (110), IMAP (143) to receive, where From/To/Subject and attachments are key to phishing analysis.