Case: a regular connection, judged from timing
A destination that wakes on a steady interval is a lead. Timing alone does not name the program, and several ordinary agents look the same.
Measure one pair, with the displayed delta
Pick the pair before you talk about regularity. Conversations, TCP tab, shows a destination the lab client talks to all morning. Apply that pair as a filter. Add frame.time_delta_displayed as a column, or set the time format to seconds since the previous displayed packet. The gaps you read are then gaps in this conversation, not gaps filled with everyone else’s packets.
Decide what event you are spacing. A new handshake every minute is a series of connections: filter tcp.flags.syn == 1 && tcp.flags.ack == 0 inside the pair, and read the displayed delta between SYNs. A keepalive inside one long connection is tcp.analysis.keep_alive, a different mechanism with a different flag. Write down which of the two you measured.
ip.addr == 10.8.0.40 && ip.addr == 203.0.113.50 && tcp.flags.syn == 1 && tcp.flags.ack == 0
Worked case: once a minute, to one name, while the console was idle
The lab workstation 10.8.0.40 is idle at the keyboard. Over forty minutes it opens TCP/443 to 203.0.113.50, server name check.example.test, about every sixty seconds. The displayed gap between SYNs clusters between 58 and 63 seconds. Each connection is small, a few kilobytes, and then it closes. The I/O graph in packets, one-minute buckets, shows a flat comb. The byte graph shows the same comb, short.
You write: client 10.8.0.40, destination 203.0.113.50, port 443, SNI check.example.test, new handshake every 58–63 seconds, small transfers, from 09:00 to 09:40, user idle, capture taken on the client. You do not write that the program is malicious. A license check, an update agent, and a telemetry client all produce this shape. The next step is the software inventory and the host’s owner, with the server name in hand.
What else is regular
NTP to a lab time server is regular and usually UDP/123 with tiny payloads. DNS to 10.8.0.53 can be regular when a page refreshes. TCP keepalives fire on an idle connection you already explained. A browser with a tab open may poll a site the user chose. Regularity is the reason you asked. The inventory is the reason you stop or continue.
A gap that jitters by a few seconds is still regular. Real timers drift. You are looking for a cluster around one interval across many samples, not for a metronome. Ten samples is a better story than two. A single repeated connection is a coincidence.
The note a defender can check
Include the filter and the command that reprints the times, so someone else can recompute the gaps. The server name is on the Client Hello, a moment after the SYN, so the command below selects handshake type 1 and the gap between those rows is the gap between new TLS sessions. Include what you ruled out with a field: each event was a new handshake, not a keepalive; the server name was present; the console was idle according to the person who sat there. Include the capture point.
Nothing in the timing tells you to block the address on a network you do not run. On a lab network you do run, the owner can decide whether check.example.test is an allowed agent. The capture’s job ends at the measured interval and the identity of the peer.
tshark -n -r lab.pcapng -Y "ip.src == 10.8.0.40 && ip.dst == 203.0.113.50 && tls.handshake.type == 1" -T fields -e frame.time_relative -e frame.len -e tls.handshake.extensions_server_name
Diagram
From a repeated destination to an interval you can recompute
- Pair
Choose one destination from the TCP conversation list.
- Event
Decide whether you are spacing new SYNs or keepalives inside one stream.
ip.addr == 10.8.0.40 && ip.addr == 203.0.113.50 && tcp.flags.syn == 1 && tcp.flags.ack == 0
- Delta
Read frame.time_delta_displayed between those rows. Note the cluster, not a single gap.
- Name
Attach the server name, the size, the idle context, and the inventory question.
Check yourself
1. The client opens a new connection to one address about every minute. Which measurement matches that claim?
2. The gaps cluster around 60 seconds with a few seconds of drift, to a named TLS host, while the user is idle. What can you conclude?
3. How do keepalives differ from the pattern in this case?