Discovering unusual traffic patterns

In this recipe, we will learn what usual and unusual traffic patterns are and how to distinguish between them.

Getting ready

The first thing is to locate Wireshark. There are several options for this:

1. When you suspect an attack that comes from the internet, locate Wireshark after the firewall (1), and when you suspect that it crosses the firewall, locate it before (2).
2. When you suspect malicious traffic coming from a remote office, port-mirror traffic coming on the central line before (3) or after (4) the router. In this case, you can filter the suspicious traffic with IP networks to see patterns from different offices in order to isolate the problematic office.
3. You can also port-mirror...