Security Concepts · Topic 8 of 8
The Five Tuple and Detection Methods
Use the five tuple to isolate a compromised host in grouped logs, and compare rule based detection with behavioural and statistical detection methods.
- 5 min
- Includes a diagram
- The five tuple is source IP, destination IP, source port, destination port and protocol.
- It identifies one flow in a set of logs.
- To find a compromised host, filter on the bad destination and read the internal source address.
What it is
The five tuple is the set of five values that identify one network conversation, and detection methods are the ways a tool decides that a conversation is bad.
The five values are the source IP address, destination IP address, source port, destination port and protocol. Together they pick out a single flow in a set of logs.
Detection can be rule based, which looks for known bad patterns, or behavioural and statistical, which looks for what is unusual.
How it works
The five tuple lets you narrow a large log set to one host, and the detection method decides what raises the alert.
The five tuple
| Element | Example | What it tells you |
|---|---|---|
| Source IP address | 10.1.1.25 | Which host started the traffic |
| Destination IP address | 203.0.113.50 | Where it was going |
| Source port | 49821 | Which client side connection it was |
| Destination port | 443 | Which service it targeted |
| Protocol | TCP | Transport used |
The destination port usually shows the service. Port 443 suggests HTTPS and port 53 suggests DNS. The source port is normally a high number that the client picks, and it is different for each new connection.
Isolating a compromised host
Suppose a log set holds thousands of firewall records. An intrusion alert names a destination address that is known to be malicious. Follow these steps.
- Filter the logs for the malicious destination address.
- Read the source address in each matching record. That is the internal host talking to the bad address.
- Filter all logs for that source address to see everything else it did.
- Look at destination ports and protocols to see what the host was doing.
- Check the timing, to see when the activity started.
A log entry might look like this.
10.1.1.25:49821 -> 203.0.113.50:443 TCP allow bytes=18200
10.1.1.25:49822 -> 203.0.113.50:443 TCP allow bytes=18400
10.1.1.40:51200 -> 198.51.100.7:53 UDP allow bytes=90The first two lines share a source host and a bad destination. Host 10.1.1.25 is the likely compromised system. The third line belongs to a different host and different service, so it is a separate matter.
Repeated connections from one host to the same destination at regular intervals can suggest beaconing, where malware checks in with its controller.
Rule based detection
Rule based detection matches traffic or files against known patterns. Signatures in an intrusion prevention system are a typical example.
- It is fast and gives clear, explainable alerts.
- It has few false alarms for known threats.
- It misses new or changed attacks that have no rule yet.
Behavioural and statistical detection
Behavioural detection builds a picture of normal behaviour and alerts when something departs from it. Statistical detection does the same with measured values, such as a mean and a spread, and flags results that are far outside the normal range.
- It can find new attacks that have no signature.
- It needs time to learn a baseline.
- It tends to produce more false positives, because unusual does not always mean malicious.
| Method | Finds | Weakness |
|---|---|---|
| Rule based | Known threats | Misses new ones |
| Behavioural and statistical | Unusual activity, including new threats | More false positives and a learning period |
Mature teams use both. Rules catch the common attacks cheaply, and behavioural methods cover the gaps.
What to remember for the exam
Seven facts cover most questions on this topic.
- The five tuple is source IP, destination IP, source port, destination port and protocol.
- It identifies one flow in a set of logs.
- To find a compromised host, filter on the bad destination and read the internal source address.
- The destination port usually shows which service was targeted.
- Rule based detection finds known threats and misses new ones.
- Behavioural and statistical detection finds unusual activity and can find new threats.
- Behavioural methods need a baseline and can raise more false positives.
In a log question, the internal address that talks to the known bad address is the suspect host.
Common mistakes
These four errors appear often.
Mixing up source and destination. The host that started the connection is the source. The bad server is usually the destination.
Treating the source port as the service. The service is shown by the destination port.
Expecting rule based tools to catch new attacks. They only match what they already know.
Trusting behavioural alerts as proof. Unusual activity needs investigation before you call it malicious.
A single log line is rarely the full story, so follow the host across all the logs.
Check yourself
Work through these three questions.
What are the five elements of the five tuple?
Source IP address, destination IP address, source port, destination port and protocol.
How do you find a compromised host from a known malicious destination?
Filter the logs for that destination and read the internal source address in the matching records. That host is the likely compromised system.
What is the main strength and weakness of rule based detection?
It reliably finds known threats with few false alarms, but it misses new attacks that have no rule.
Topic 8 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.