Passive reconnaissance and local artefacts¶

At boot, a host receives extensive network configuration details and continuously logs operational activity. Inspecting these local artefacts costs nothing in network noise, and on an enterprise workstation after two years in service, it provides a far more accurate picture of the estate than an outdated wiki diagram.

Local host artefacts¶

Host configuration files yield immediate structural context. A primary DNS domain suffix names the core domain, while search lists often expose unannounced sibling domains. DHCP lease parameters identify answering domain controllers, WINS servers, and network time sources, which is a critical finding because Kerberos authentication fails when clock drift exceeds roughly five minutes. Routing tables provide further network mapping: while a standard workstation requires only a default gateway, static routes usually indicate specific operational pathways, such as an engineering team accessing a process historian. The local address resolution cache reveals active communication over the preceding minutes, pointing to default gateways, local printers, or hosts on unadvertised subnets.

Identity artefacts show where authority is actively used rather than where it is merely granted. A Kerberos ticket cache lists every internal service accessed by the user that day under a standard ten-hour grant. Saved network mappings identify active file shares, while proxy configurations and bypass lists provide a direct inventory of internal web applications. Browser cookie stores contain encrypted session tokens that list every internal site visited by the user. On an engineering workstation, project files yield even richer intelligence, often exposing controller names, rack and slot addressing, tag lists, and cleartext passwords saved during initial commissioning.

Passive network traffic and protocol chatter¶

Unprompted network traffic reveals structural details without sending a single packet. Failed name resolution requests broadcast continuously, exposing typos, decommissioned servers, and legacy network shares still mapped by hand. Local discovery traffic names connected printers, displays, and storage appliances, often accompanied by specific model numbers and firmware revisions. Service announcements reveal naming conventions, which are frequently more valuable than individual hostnames.

On industrial process networks, unprompted data streams are even more explicit. Telemetry protocols like IEC 104 broadcast spontaneous transmissions over port 2404 in cleartext, using application layer structure identifiers to separate measured values from control commands. A passive packet capture on this port reveals controller addressing, polling cadences, and writeable memory points without transmitting data. Siemens S7 communications over port 102 offer similar operational visibility through unprompted session traffic.

Establishing an operational baseline¶

Observing a network silently for twenty-four hours establishes normal operational baseline behaviour. This includes five-minute service account authentication cycles, scheduled off-hours backups saturating uplinks between one and three in the morning, shift rotations at seven and midnight, and typical Thursday afternoon application error rates.

Establishing this baseline before any active testing is what makes it worth having, as measurements taken after probing begins only capture a network already responding to anomalies. Every subsequent activity is evaluated against this initial baseline to measure detection and operational impact.