The 5-Tuple Approach
Uniquely Identifying Network Sessions for Traffic Analysis
Section 1 of 4
0% Complete
What is the 5-Tuple?
In network traffic analysis, the 5-tuple is a set of five values that uniquely identifies a bidirectional network flow or session. Every packet traveling across a network contains these five pieces of information.
1
Source IP
192.168.1.100
2
Destination IP
10.0.0.50
3
Source Port
52431
4
Destination Port
443
5
Protocol
TCP (6)
Key Insight
- The 5-tuple uniquely identifies a session or flow between two endpoints
- Changing any single value creates a different flow
- SOC analysts use 5-tuples to track, correlate, and investigate network activity
- Firewalls, IDS/IPS, and SIEM systems all rely on 5-tuple matching
Why Does This Matter for SOC Analysts?
Firewall Rules
Firewall policies match on 5-tuple values to permit or deny traffic. Understanding this helps you read and write effective rules.
NetFlow Analysis
NetFlow/IPFIX records are organized by 5-tuple. You'll query flows using these fields constantly.
Threat Hunting
When investigating alerts, you'll pivot on source/destination IPs and ports to find related malicious activity.
Session Correlation
Correlating events across logs requires matching 5-tuples to reconstruct what happened during an incident.