Incident Detection · Topic 1 of 4
Network Traffic Monitoring and Baselines
Learn why network traffic monitoring matters, how SPAN ports and TAPs feed sensors, and how to baseline normal and suspicious traffic for CND 312-38.
- 5 min
- Monitoring is the detect step, and a baseline defines normal.
- SPAN is built into the switch and can drop packets. A TAP is passive and captures far more reliably.
- Flow data (NetFlow, IPFIX, sFlow) shows conversations, not content.
What it is
Network traffic monitoring is the continuous collection and review of the traffic that crosses a network, so a defender can see attacks, failures and policy violations. It is the first step of detection in the protect, detect, respond, predict approach.
A baseline is a record of what normal traffic looks like. Without a baseline you cannot say what is abnormal.
How it works
Need and advantages of monitoring
Prevention controls fail sometimes. Monitoring shows what got through and what is trying.
| Advantage | Why it helps |
|---|---|
| Early detection | Finds scans, malware beaconing and data theft sooner |
| Visibility | Shows which hosts, protocols and users use the network |
| Faster response | Gives analysts evidence to scope an incident |
| Troubleshooting | Separates attacks from ordinary faults |
| Compliance | Supports requirements for logging and monitoring |
| Policy enforcement | Reveals unapproved applications and shadow IT |
| Evidence | Captured traffic can support an investigation |
Setting up the monitoring environment
The sensor must see the traffic. There are three common ways to feed it.
| Method | How it works | Notes |
|---|---|---|
| SPAN or port mirroring | A switch copies traffic from selected ports or VLANs to a monitor port | Cheap and easy, but can drop packets under load and adds switch load |
| Network TAP | A hardware device sits in the link and copies its traffic | Passive, with little or no packet loss. Costs more |
| Flow export | Routers and switches send summaries (NetFlow, IPFIX, sFlow) to a collector | Shows who talked to whom, not the content |
Planning points:
- Place sensors at the network edge, at the data center core, between key internal segments and at cloud or remote links. Internal monitoring is needed because attackers move sideways.
- Put the sensor interface in promiscuous mode so it reads traffic not addressed to it, and keep its management interface separate and protected.
- Size storage for packet captures. Full capture needs a lot, so keep it short and keep flow records longer.
- Synchronize time with NTP so events line up across devices.
- Encrypted traffic hides content. Use metadata and flow data, or inspect at a controlled decryption point.
- Limit who can read captures, because they may contain passwords and personal data.
Common tools by role: a packet analyzer (Wireshark), a network IDS (Snort, Suricata), a network traffic analysis product, and a flow collector. Name the role, not the product, in most exam questions.
Baseline traffic signatures
Capture traffic during normal operation across a full business cycle, including busy and quiet hours, month end and backup windows.
| Baseline item | Example of normal |
|---|---|
| Protocol mix | Mostly HTTPS and DNS, some SMB and email |
| Top talkers | File server and proxy send the most traffic |
| Active hours | Peaks in business hours, backups at night |
| Bandwidth | Typical utilization per link |
| Connections | Usual destinations, ports and countries |
| DNS | Normal query volume and domains |
Normal is known and approved. Suspicious traffic is the deviation, and it often looks like these patterns:
- Connections to uncommon ports, or services running on unusual ports
- Large outbound transfers at odd hours, which can mean data exfiltration
- Regular, timed connections to the same external host (beaconing)
- Many connection attempts across many ports or hosts (scanning)
- A flood of SYN packets, or large ICMP or UDP volume (DoS)
- Unusual DNS: very long names, high volume, many failed lookups
- Internal hosts talking to each other in ways they never did (lateral movement)
- Traffic from unexpected countries or to known bad addresses
A baseline must be refreshed after major changes, and a compromised network during the baseline period would teach the wrong lesson.
A worked example
An analyst sees that a workstation in accounting sent 4 GB to an unfamiliar external address at 3 a.m. The baseline for that host shows about 50 MB a day, all to internal servers and a few known sites.
The size, time and destination all deviate. The analyst escalates it as possible exfiltration, isolates the host and starts the incident response process.
How the exam asks about this
- "Which method copies traffic from a switch port to a monitoring port?" → Port mirroring (SPAN).
- "Which device passively copies traffic from a link with little or no packet loss?" → A network TAP.
- "A host contacts the same external server every 60 seconds. What does this suggest?" → Beaconing, which can indicate malware command and control.
What to remember for the exam
- Monitoring is the detect step, and a baseline defines normal.
- SPAN is built into the switch and can drop packets. A TAP is passive and captures far more reliably.
- Flow data (NetFlow, IPFIX, sFlow) shows conversations, not content.
- Time must be synchronized across all devices.
- Update baselines after network changes.
Captured packets can hold credentials and personal data. Protect the capture files and limit access.
Common mistakes
Monitoring only the perimeter. Internal sensors catch lateral movement that never crosses the edge.
Building a baseline from one quiet day. Cover peaks, backups and month end.
Assuming unusual always means malicious. A new app or backup can look odd, so verify before escalating.
Check yourself
What is the main drawback of SPAN compared with a TAP?
A SPAN port can drop packets when overloaded, while a TAP copies the link traffic with little or no loss.
Why is a baseline needed?
It defines normal behavior so deviations can be identified.
Name two signs of suspicious traffic.
Large outbound transfers at odd hours and regular beaconing to an external host.
Topic 1 of 4 in Incident Detection
Test yourself on Incident Detection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.