Detecting C2 traffic focuses on identifying communication between compromised hosts and attacker-controlled command-and-control servers. C2 channels allow attackers to send commands, exfiltrate data, and maintain persistence. Because modern C2 often uses encryption or covert channels, detection relies on behavioral patterns, metadata, timing analysis, and protocol anomalies rather than content inspection alone.

Understanding C2 Communication Patterns

C2 traffic exhibits behavioral indicators such as:

• Regular beacon intervals

• Low-and-slow communication

• Unusual destination IPs or domains

• Suspicious TLS fingerprints

• Encrypted traffic to unknown servers

• Protocol misuse (DNS, HTTPS, ICMP)

• Odd user-agent strings

Attackers design C2 to blend in, but patterns remain detectable.

Detecting C2 with Packet Capture

Capturing traffic is the first step in identifying suspicious activity.

Capturing All Traffic

sudo tcpdump -i eth0 -w capture.pcap

Reviewing the pcap helps identify repeated connections or unusual patterns.

Filtering for Repeated Connections

sudo tcpdump -i eth0 host <suspected_ip>

Regular periodic packets to the same IP often indicate beaconing.

Identifying Beaconing Behavior

C2 agents typically contact the C2 server at fixed intervals.

Beacon Detection in Wireshark

Use:

tcp.stream eq X

Examine timing in the TCP stream graph for consistent intervals.

Indicators include:

• Identical packet size

• Identical time intervals

• Same destination IP

• Same destination port

This pattern is uncommon in normal user traffic.

Inspecting DNS-Based C2

DNS is a popular channel for covert C2.

Capturing DNS Traffic

sudo tcpdump -i eth0 port 53

Indicators include:

• Long or random-looking subdomains

• High frequency of DNS queries

• Large TXT records

• DNS queries to unknown domains

• Repeated NXDOMAIN responses

Suspicious patterns may indicate DNS tunneling or malware activity.

Filtering Suspicious DNS in Wireshark

dns.qry.name contains "."

Look for entropy or patterns suggesting encoded data.

Detecting HTTP C2

HTTP C2 attempts to appear as normal web traffic but contains anomalies.

Capturing HTTP Traffic

sudo tcpdump -i eth0 port 80

Indicators include:

• Strange or rare User-Agent values

• Repeated identical GET requests

• URLs containing encoded data

• Absence of normal browser headers

• Responses with minimal content

HTTP C2 often avoids cookies, referrers, or modern browser behavior.

Detecting HTTPS C2

HTTPS hides payload but leaks metadata.

Capturing TLS Handshakes

sudo tcpdump -i eth0 port 443

Suspicious TLS indicators:

• Self-signed certificates

• Unknown certificate authorities

• Very small TLS packets

• Repeated identical-length encrypted packets

• Rare cipher suites or outdated TLS versions

• TLS negotiation anomalies

Use SNI identification:

Wireshark filter:

tls.handshake.extensions_server_name

Unknown or strange domains suggest malicious C2.

Detecting C2 Over ICMP

ICMP is sometimes used for covert C2.

Capturing ICMP Traffic

sudo tcpdump -i eth0 icmp

Indicators:

• ICMP packets with payload data

• Regular intervals

• Unusual packet sizes

• Echo requests without normal patterns

ICMP is rarely used for large data transfers, so anomalies stand out.

Detecting C2 with Zeek

Zeek logs high-level metadata that helps reveal C2 patterns.

Running Zeek

sudo zeek -i eth0

Review logs in:

• conn.log for unusual destinations

• dns.log for suspicious queries

• ssl.log for certificate anomalies

• http.log for strange User-Agents

Zeek’s behavior-based logging makes C2 patterns visible.

Detecting C2 with Suricata

Suricata uses signatures and behavioral rules.

Running Suricata

sudo suricata -i eth0 -l /var/log/suricata

Suricata detects:

• Known malware domains

• C2 signatures

• TLS anomalies

• DNS tunneling patterns

• Beaconing structures

Logs appear in eve.json.

Behavioral Indicators of C2

Common behavioral signs include:

• Periodic beaconing

• Unusual persistence of connections

• Communication to high-risk countries or cloud VPS hosts

• Constant small encrypted packets

• Rare or malformed protocol usage

• DNS queries with high entropy

• Protocols used in unusual ways (HTTP POST every exact 30 seconds)

Consistent timing and low data volume are strong indicators.

Why Detecting C2 Traffic Matters

C2 detection reveals active compromises. Identifying C2 channels helps:

• Detect malware infections

• Stop data exfiltration

• Prevent attacker control

• Trigger incident response

• Map attacker behavior

• Analyze intrusion methods

C2 traffic is often the first and clearest sign of an active intrusion.

Intel Dump

• C2 traffic shows periodic beacons, unusual destinations, and protocol misuse

• Tools: tcpdump, Wireshark, Zeek, Suricata

• DNS, HTTP, HTTPS, ICMP, and TLS are common C2 channels

• Key patterns include entropy, timing, certificate anomalies, and unusual headers

• Detecting C2 is critical for identifying active compromises