An NSM analyst observes Zeek logs showing a connection where the orig_bytes is 500 and resp_bytes is 2,500,000. The destination port is 443. What does this asymmetry suggest?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because a small originator request (500 bytes) producing a very large response (2.5 MB) from an external server on 443 suggests the internal host retrieved a large payload, which could be malware download or data staging. A is wrong because DDoS attacks show inbound traffic volume exceeding outbound, but the source would be external and volume would appear in responder bytes hitting many connections.
Full explanation below image
Full Explanation
C is correct because a small originator request (500 bytes) producing a very large response (2.5 MB) from an external server on 443 suggests the internal host retrieved a large payload, which could be malware download or data staging. A is wrong because DDoS attacks show inbound traffic volume exceeding outbound, but the source would be external and volume would appear in responder bytes hitting many connections. B is wrong because data exfiltration from an internal host would show large orig_bytes, not large resp_bytes. D is wrong because an HTTP POST would show large originator bytes, not small originator bytes.