# ============================================================
# CTF Challenge: Netflow Summary Records
# Collector: 192.168.1.10
# Export format: CSV
# Duration: 30-minute capture window
# ============================================================
#
# Column definitions:
# timestamp, src_ip, src_port, dst_ip, dst_port, protocol, packets, bytes, duration_sec, tcp_flags
#
timestamp,src_ip,src_port,dst_ip,dst_port,protocol,packets,bytes,duration_sec,tcp_flags
# --- Normal web browsing ---
2026-04-09 09:00:01,192.168.1.50,49812,142.250.80.4,443,TCP,45,32400,12.5,SYN|ACK|PSH|FIN
2026-04-09 09:00:01,142.250.80.4,443,192.168.1.50,49812,TCP,52,128900,12.5,SYN|ACK|PSH|FIN
2026-04-09 09:00:15,192.168.1.105,52100,93.184.216.34,80,TCP,12,5400,3.2,SYN|ACK|PSH|FIN
2026-04-09 09:00:15,93.184.216.34,80,192.168.1.105,52100,TCP,18,24100,3.2,SYN|ACK|PSH|FIN
2026-04-09 09:00:30,192.168.1.50,55200,151.101.1.140,443,TCP,89,64200,25.1,SYN|ACK|PSH|FIN
2026-04-09 09:00:30,151.101.1.140,443,192.168.1.50,55200,TCP,112,312000,25.1,SYN|ACK|PSH|FIN
# --- C2 BEACON PATTERN: Regular intervals (~60s) to same destination ---
2026-04-09 09:01:00,192.168.1.200,48901,45.33.92.157,443,TCP,8,2048,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:01:00,45.33.92.157,443,192.168.1.200,48901,TCP,6,1536,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:02:01,192.168.1.200,48902,45.33.92.157,443,TCP,8,2112,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:02:01,45.33.92.157,443,192.168.1.200,48902,TCP,6,1480,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:03:00,192.168.1.200,48903,45.33.92.157,443,TCP,8,2080,1.3,SYN|ACK|PSH|FIN
2026-04-09 09:03:00,45.33.92.157,443,192.168.1.200,48903,TCP,6,1520,1.3,SYN|ACK|PSH|FIN
2026-04-09 09:04:02,192.168.1.200,48904,45.33.92.157,443,TCP,8,2096,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:04:02,45.33.92.157,443,192.168.1.200,48904,TCP,6,1504,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:05:01,192.168.1.200,48905,45.33.92.157,443,TCP,8,2064,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:05:01,45.33.92.157,443,192.168.1.200,48905,TCP,6,1488,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:06:00,192.168.1.200,48906,45.33.92.157,443,TCP,8,2048,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:06:00,45.33.92.157,443,192.168.1.200,48906,TCP,6,1536,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:07:01,192.168.1.200,48907,45.33.92.157,443,TCP,8,2080,1.3,SYN|ACK|PSH|FIN
2026-04-09 09:07:01,45.33.92.157,443,192.168.1.200,48907,TCP,6,1520,1.3,SYN|ACK|PSH|FIN
2026-04-09 09:08:02,192.168.1.200,48908,45.33.92.157,443,TCP,8,2112,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:08:02,45.33.92.157,443,192.168.1.200,48908,TCP,6,1504,1.1,SYN|ACK|PSH|FIN
# NOTE: 192.168.1.200 -> 45.33.92.157:443 every ~60s, consistent packet/byte counts
# --- Normal email traffic ---
2026-04-09 09:02:30,192.168.1.75,61200,52.97.151.18,443,TCP,34,18200,8.4,SYN|ACK|PSH|FIN
2026-04-09 09:02:30,52.97.151.18,443,192.168.1.75,61200,TCP,48,96500,8.4,SYN|ACK|PSH|FIN
# --- Normal DNS ---
2026-04-09 09:03:10,192.168.1.50,49813,8.8.8.8,53,UDP,1,72,0.1,
2026-04-09 09:03:10,8.8.8.8,53,192.168.1.50,49813,UDP,1,104,0.1,
2026-04-09 09:03:45,192.168.1.105,49900,8.8.8.8,53,UDP,1,68,0.1,
2026-04-09 09:03:45,8.8.8.8,53,192.168.1.105,49900,UDP,1,96,0.1,
# --- DATA EXFILTRATION: Large outbound transfer ---
2026-04-09 09:10:00,192.168.1.200,49100,185.220.101.42,443,TCP,1250,1843200,45.2,SYN|ACK|PSH|FIN
2026-04-09 09:10:00,185.220.101.42,443,192.168.1.200,49100,TCP,420,28800,45.2,SYN|ACK|PSH|FIN
# NOTE: 1.8 MB outbound vs 28 KB inbound — highly asymmetric, suggests data upload
2026-04-09 09:12:00,192.168.1.200,49101,185.220.101.42,443,TCP,980,1425600,38.7,SYN|ACK|PSH|FIN
2026-04-09 09:12:00,185.220.101.42,443,192.168.1.200,49101,TCP,310,21200,38.7,SYN|ACK|PSH|FIN
2026-04-09 09:15:00,192.168.1.200,49102,185.220.101.42,443,TCP,1480,2150400,52.1,SYN|ACK|PSH|FIN
2026-04-09 09:15:00,185.220.101.42,443,192.168.1.200,49102,TCP,520,35600,52.1,SYN|ACK|PSH|FIN
# NOTE: 185.220.101.42 is a known Tor exit node IP range — exfil destination
# --- LATERAL MOVEMENT: Internal SMB scanning ---
2026-04-09 09:08:10,192.168.1.200,49500,192.168.1.10,445,TCP,12,2400,0.8,SYN|ACK|PSH|RST
2026-04-09 09:08:11,192.168.1.200,49501,192.168.1.11,445,TCP,3,180,0.3,SYN|RST
2026-04-09 09:08:11,192.168.1.200,49502,192.168.1.12,445,TCP,3,180,0.3,SYN|RST
2026-04-09 09:08:12,192.168.1.200,49503,192.168.1.15,445,TCP,12,2400,0.9,SYN|ACK|PSH|RST
2026-04-09 09:08:12,192.168.1.200,49504,192.168.1.20,445,TCP,3,180,0.2,SYN|RST
2026-04-09 09:08:13,192.168.1.200,49505,192.168.1.25,445,TCP,3,180,0.3,SYN|RST
2026-04-09 09:08:13,192.168.1.200,49506,192.168.1.30,445,TCP,18,8400,2.1,SYN|ACK|PSH|FIN
2026-04-09 09:08:14,192.168.1.200,49507,192.168.1.35,445,TCP,3,180,0.2,SYN|RST
2026-04-09 09:08:14,192.168.1.200,49508,192.168.1.40,445,TCP,3,180,0.3,SYN|RST
2026-04-09 09:08:15,192.168.1.200,49509,192.168.1.50,445,TCP,12,2400,0.7,SYN|ACK|PSH|RST
# NOTE: 192.168.1.200 scanning internal /24 on port 445 (SMB) — rapid sequential connections, many RST = closed ports
# --- Lateral movement: Successful SMB session after scan ---
2026-04-09 09:09:00,192.168.1.200,49600,192.168.1.30,445,TCP,245,186400,120.5,SYN|ACK|PSH
2026-04-09 09:09:00,192.168.1.30,445,192.168.1.200,49600,TCP,310,428000,120.5,SYN|ACK|PSH
# NOTE: Extended SMB session to .30 (the host that responded) — file share access
# --- Lateral movement: RDP to compromised host ---
2026-04-09 09:11:30,192.168.1.200,49700,192.168.1.30,3389,TCP,890,245000,180.3,SYN|ACK|PSH
2026-04-09 09:11:30,192.168.1.30,3389,192.168.1.200,49700,TCP,1240,1820000,180.3,SYN|ACK|PSH
# --- Normal internal traffic ---
2026-04-09 09:05:00,192.168.1.75,62100,10.0.5.20,80,TCP,22,8400,4.1,SYN|ACK|PSH|FIN
2026-04-09 09:05:00,10.0.5.20,80,192.168.1.75,62100,TCP,28,42000,4.1,SYN|ACK|PSH|FIN
2026-04-09 09:06:30,192.168.1.50,55300,18.164.80.5,443,TCP,56,28400,15.2,SYN|ACK|PSH|FIN
2026-04-09 09:06:30,18.164.80.5,443,192.168.1.50,55300,TCP,78,184000,15.2,SYN|ACK|PSH|FIN
# --- ICMP tunnel (captured as flows) ---
2026-04-09 09:14:45,192.168.1.200,0,45.33.92.157,0,ICMP,8,8192,3.2,
2026-04-09 09:14:45,45.33.92.157,0,192.168.1.200,0,ICMP,8,8192,3.2,
# NOTE: 8192 bytes in 8 ICMP packets = 1024 bytes/packet — oversized, tunnel indicator
# --- More C2 beacons continuing ---
2026-04-09 09:09:01,192.168.1.200,48909,45.33.92.157,443,TCP,8,2048,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:09:01,45.33.92.157,443,192.168.1.200,48909,TCP,6,1536,1.2,SYN|ACK|PSH|FIN
2026-04-09 09:10:02,192.168.1.200,48910,45.33.92.157,443,TCP,8,2096,1.1,SYN|ACK|PSH|FIN
2026-04-09 09:10:02,45.33.92.157,443,192.168.1.200,48910,TCP,6,1504,1.1,SYN|ACK|PSH|FIN
# --- Summary Statistics ---
# Total flows: 68
# Unique source IPs: 5 (192.168.1.50, .75, .105, .200, external responses)
# Unique destination IPs: 14
# Top talker by bytes out: 192.168.1.200 (5,667,200 bytes outbound)
# Suspicious host: 192.168.1.200 — C2 beacon, lateral movement, data exfiltration
