Network Traffic Flow

Summarized network packet data that captures session-level details such as source/destination IPs, ports, protocol types, timestamps, and data volume, without storing full packet payloads. This is commonly used for traffic analysis, anomaly detection, and network performance monitoring.

Data Collection Measures:

• Network Flow Logs (Metadata Collection)
  • NetFlow
    • Summarized metadata for network conversations (no packet payloads).
  • sFlow (Sampled Flow Logging)
    • Captures sampled packets from switches and routers.
    • Used for real-time traffic monitoring and anomaly detection.
  • Zeek (Bro) Flow Logs
    • Zeek logs session-level details in logs like conn.log, http.log, dns.log, etc.
• Host-Based Collection
  • Sysmon Event ID 3 – Network Connection Initiated
    • Logs process-level network activity, useful for detecting malicious outbound connections.
  • AuditD (Linux) – syscall=connect
    • Monitors system calls for network connections. auditctl -a always,exit -F arch=b64 -S connect -k network_activity
• Cloud & SaaS Flow Monitoring
  • AWS VPC Flow Logs
    • Captures metadata for traffic between EC2 instances, security groups, and internet gateways.
  • Azure NSG Flow Logs / Google VPC Flow Logs
    • Logs ingress/egress traffic for cloud-based resources.