Traffic Triage: The C2 Beacon and the Exfil in the Capture

10.0.0.5 is behaving oddly and you're on the wire. The capture was decoded to text at /root/case/capture.txt with tcpdump -nnr capture.pcap — timestamped flows, one per line:

TIME IP SRC.PORT > DST.PORT: Flags [..], length N

baseline.txt lists the host's known-good talkers. Two attacker behaviours hide in the noise:

• Command & control (beaconing): an implant phones home on a timer — the same external IP, small same-size packets, arriving at a fixed interval. Regularity, not volume, is the tell.
• Exfiltration: a bulk outbound transfer — many full-size packets to one destination in a burst. Volume is the tell.

Record three findings:

1. /root/case/c2.txt — the C2 IP (the periodic beacon's destination; not in the baseline).

2. /root/case/interval.txt — the beacon interval, as a number of seconds (a bare number like 90; 90s is accepted too).

3. /root/case/exfil.txt — the exfiltration destination IP (the bulk transfer).

The biggest talker is NOT the C2 — that's the point. tcpdump/grep/awk are all you need.