1. Protocol misuse / abnormal volume

• ICMP spikes (especially large payloads or frequent echo requests/replies) → Possible tunneling (covert data channel)
• DNS unusually busy (high query rate, long/random domains) → DNS tunneling or data exfiltration
• HTTP/HTTPS with non-web patterns (constant small requests, odd intervals) → C2 beaconing

2. Beaconing behavior

• Regular, repeating intervals (e.g., every 30s, 60s exactly) → Command-and-control callbacks
• Low, consistent packet size → Heartbeat/check-in traffic

3. Odd packet structure

• Unusual packet sizes (very large or very small consistently)
• High entropy payloads (looks random) → Encrypted or obfuscated data
• Fragmented packets (especially unnecessary fragmentation) → Evasion of IDS/IPS

4. Suspicious port usage

• Traffic on non-standard ports (e.g., HTTP on 8081, DNS on 5355 externally)
• Common ports used incorrectly:
  • Port 53 carrying non-DNS data
  • Port 443 without proper TLS handshake

5. Protocol anomalies

• Malformed packets (bad headers, incorrect flags) → Evasion attempts or crafted exploits