A Zeek analyst notices that a connection log shows a large number of sessions to a single external IP with very short durations and fixed byte counts. This pattern is most consistent with which type of activity?
Select an answer to reveal the explanation.
Short Explanation
You're seeing beaconing malware checking in with a command-and-control server because short, repeated sessions to one external IP with fixed byte counts are classic check-in behavior. TLS failures, normal CDN browsing, and bulk SMTP don't fit that fixed, single-destination pattern.
Full Explanation
Beaconing malware checking in with a command-and-control server is correct because periodic short sessions with consistent byte counts to a single external IP is a classic beaconing pattern used by malware for command-and-control communication. The TLS handshake failure causing retransmissions is wrong because TLS failures produce variable patterns and typically resolve or stop, not repeat at fixed intervals. Normal web browsing sessions to a content delivery network is wrong because CDN traffic shows connections to many IPs with varying session sizes. An SMTP server delivering bulk mail is wrong because SMTP delivery shows connections to many recipient mail servers, not repeated connections to a single IP.