RR CYBERLAB • Network Security
Network Traffic Investigation: North-South vs East-West
Learn how traffic direction and network zones affect investigation priorities.
QUICK READ
North-south traffic generally describes traffic entering or leaving an environment. East-west traffic describes communication between internal systems. Both can contain legitimate or suspicious behavior.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
East-west
Internal host-to-host traffic can support administration, application communication and lateral movement. Asset roles and segmentation are critical.Investigation workflow
- Identify source and destination zones.
- Determine expected communication for the asset pair.
- Check ports, protocols and frequency.
- Correlate identity, endpoint and authentication events.
- Look for movement across multiple hosts or unusual administrative activity.
Example
A file server communicating with application servers may be normal. A user workstation suddenly contacting many servers over SMB is a different pattern and deserves contextual investigation.Common mistakes
- Assuming internal traffic is safe.
- Applying a north-south detection expectation to an east-west environment.
- Ignoring business application dependencies.
Daily quiz hook
A workstation begins communicating with several internal servers over SMB. Why is the east-west context important?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
New to packet headers? Read the packet-by-packet and OSI encapsulation walkthrough →
Analyst practice note
North-south traffic crosses an organization’s perimeter or major boundary; east-west traffic moves between internal systems or segments. These labels depend on the network design, so use the actual topology and sensor location rather than assuming every organization has the same boundaries.
Trace a synthetic workstation-to-server flow and identify which controls and logs could observe it. Then consider what a single sensor would miss, such as traffic that stays within a switched segment or a cloud service path.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.