An analyst is analyzing a PCAP file and identifies a TCP stream where large volumes of data are sent from an internal host to an external destination over port 443, but the traffic patterns do not match standard TLS handshake sequences. What should the analyst investigate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — if you see large transfers on port 443 that don't match normal TLS handshakes, investigate whether it's a non-TLS protocol tunneled over 443 to slip past HTTPS-only firewall rules. Malware and attackers do this to blend in with allowed outbound traffic.
Full Explanation
The correct investigation is whether the connection represents a non-TLS protocol tunneled over port 443 to bypass firewall rules that only allow HTTPS. Attackers and malware often tunnel custom command-and-control protocols over port 443 specifically because most firewalls permit HTTPS outbound; traffic lacking proper TLS handshake patterns on port 443 may indicate a custom tunneling protocol designed to blend with allowed HTTPS traffic. Checking whether the external server has an expired SSL certificate is wrong because expired certificates cause TLS handshake errors and typically result in refused connections, not large data flows. Checking whether the internal host needs a software update to fix TLS compatibility issues is wrong because TLS compatibility issues cause connection failures, not large successful data transfers with non-standard patterns. Checking whether the packet capture tool dropped packets causing an incomplete handshake is wrong because packet drops cause missing segments, not completely different traffic patterns.