Question

As a network engineer for a large corporation, you have been monitoring network traffic and notice that several client devices are beginning to communicate with each other (instead of the normal client-to-server communication).

Besides monitoring network traffic, what else should you be doing to analyze this irregular peer-to-peer communication?

answer

Update your configuration documentation to show which server ports are allowed on any given host type.


Configure detection rules to detect mismatched protocol usage over a standard port.


Regularly review a traffic map that show common network traffic flows.


Configure firewalls to allow only allow listed ports.

Answer 1

All four items you listed are appropriate — and you should do several additional things as part of a structured analysis and response. Recommended steps, ordered roughly by priority:

Immediate/containment
- Isolate or segment the affected hosts (or quarantine via NAC/EDR) to stop further peer-to-peer chatter if you suspect compromise.
- Temporarily block or restrict the unexpected flows at firewall/ACLs while you investigate.

Evidence collection and analysis
- Capture full packet traces (PCAP) on affected links/hosts and export NetFlow/IPFIX records to analyze endpoints, ports, timings, and payloads.
- Pull endpoint data: process list, netstat/listening ports, autoruns, logs, EDR alerts, and recent software installs.
- Correlate with DNS logs, proxy logs, and SIEM events to identify command-and-control, lateral-movement behavior, or user activity.

Detection and prevention
- Configure detection rules (IDS/IPS, SIEM) to flag protocol mismatches (e.g., non-HTTP on port 80) and unusual client-to-client flows — your suggestion about mismatched-protocol detection is good.
- Harden firewall/ACLs to a default-deny, allow-listed (whitelist) model so only approved ports/services are reachable; apply microsegmentation where practical.
- Update and tune intrusion detection/prevention signatures to catch the observed behavior.

Documentation and monitoring
- Update configuration documentation to record which server ports/services are allowed per host type. This helps spot deviations quickly.
- Regularly review and maintain a traffic map/topology and baseline of normal flows so anomalous P2P traffic stands out.
- Create dashboards/alerts for user-to-user flows, sudden increases in internal connections, and unusual protocol usage.

Remediation and follow-up
- If hosts are compromised, perform forensic analysis, remove malware, rebuild or restore clean images, and change credentials where necessary.
- Patch vulnerable software and review application policies (e.g., block unauthorized P2P apps).
- Inform incident response stakeholders and update incident post-mortem / playbooks.

Notes and cautions
- Verify that the P2P traffic isn’t legitimate (collab tools, update services, distributed apps) before broad blocking.
- Keep detection rules and firewall changes staged and tested to reduce risk of business disruption.

In short: collect packets and endpoint evidence, quarantine if needed, deploy detection rules and whitelist-based firewalling, and keep your documentation and traffic maps up to date.