4.8 Interpret the fields in protocol headers as related to intrusion analysis
📘Cisco Certified CyberOps Associate (200-201 CBROPS)
An Ethernet frame is the basic unit of data that travels over a wired Ethernet network. Think of it as a package of data that computers send to each other on the same local network (LAN). Understanding Ethernet frames is critical for intrusion analysis because every network attack leaves traces in these frames.
In intrusion detection, you’ll examine Ethernet frames in PCAP files (captured network traffic) to see where attacks come from, what devices are involved, and which protocols are being used.
1. Structure of an Ethernet Frame
An Ethernet frame has several important fields. Each field has a purpose, and knowing them helps identify suspicious activity.
| Field | Description | Exam Tip / Example in IT Environment |
|---|---|---|
| Preamble | 7 bytes that prepare the network card for receiving data. | Usually not directly seen in packet captures but part of the frame start. |
| Start Frame Delimiter (SFD) | 1 byte marking the start of the frame. | Helps network devices recognize the beginning of data. |
| Destination MAC Address | 6 bytes specifying which device should receive the frame. | In intrusion analysis, this shows the target device. Suspicious frames may have a broadcast MAC (ff:ff:ff:ff:ff:ff) or an unknown device. |
| Source MAC Address | 6 bytes showing which device sent the frame. | Identifies the attacker’s device on the network. Comparing source MAC addresses can detect spoofing attacks. |
| EtherType / Length | 2 bytes indicating either the protocol being carried (IPv4, ARP, IPv6, etc.) or the length of the payload. | Helps determine what higher-level protocol is being used. Suspicious frames may carry unexpected protocols. |
| Payload (Data) | 46–1500 bytes containing the actual data being sent. | Can include higher-level protocols (IP, TCP, UDP). Analyzing payloads can reveal malware commands, suspicious scripts, or unauthorized data transfer. |
| Frame Check Sequence (FCS) | 4 bytes used to check for errors in the frame. | Ensures integrity. Frames with incorrect FCS may indicate corruption or malicious tampering. |
2. Key Concepts for Intrusion Analysis
- MAC Addresses
- Every device on a LAN has a unique MAC address.
- By checking the source MAC, analysts can trace the origin of traffic.
- Intruders may spoof MAC addresses to hide their device.
- EtherType / Protocol Identification
- Shows which protocol the frame is carrying (e.g., IPv4 = 0x0800, ARP = 0x0806).
- Helps analysts decide which packet to investigate further. For example, if you see ARP traffic from a suspicious source, it may be a ARP spoofing attack.
- Payload Inspection
- The payload may contain network commands or data.
- Analysts often use tools like Wireshark to decode payloads for signs of attacks such as exploits or malware traffic.
- Error Checking with FCS
- Malicious actors rarely target FCS, but corrupted frames may indicate tampering or faulty hardware.
- Frames failing FCS checks are often dropped by the network but may appear in captures.
- Broadcast vs. Unicast vs. Multicast
- Unicast: One-to-one communication (normal).
- Broadcast: One-to-all (can be used in attacks like ARP poisoning).
- Multicast: One-to-many specific group (used in streaming, but suspicious in some environments).
3. How Ethernet Frames Appear in PCAP Analysis
When analyzing a PCAP file:
- Step 1: Look at the source and destination MAC addresses to identify devices on the network.
- Step 2: Check the EtherType to know the higher-level protocol (IPv4, ARP, IPv6).
- Step 3: Inspect the payload for suspicious content.
- Step 4: Note broadcast frames which may indicate scanning or network discovery by an attacker.
Example:
- A PCAP shows many ARP requests (EtherType 0x0806) from a single source MAC to multiple devices. This could indicate ARP spoofing, a common local network attack.
4. Exam Tips
- Remember that the Ethernet frame is Layer 2 in the OSI model. IP addresses and TCP/UDP ports are Layer 3/4 inside the frame.
- For the exam, focus on:
- Source & destination MAC addresses – who is talking to whom.
- EtherType – what protocol the frame carries.
- Payload & length – how much data is transferred.
- You may be asked to identify suspicious frames (broadcasts, unknown MAC, unusual protocols).
- FCS is less likely to appear in exam questions, but knowing it checks frame integrity is enough.
5. Summary
- Ethernet frames are the building blocks of network communication.
- In intrusion analysis, the Ethernet frame gives you who is sending data, who is receiving it, and what kind of data is being sent.
- Key fields to focus on for the exam: Source MAC, Destination MAC, EtherType, and Payload.
- Recognizing unusual patterns in these fields can help detect attacks like MAC spoofing, ARP poisoning, or abnormal traffic patterns.
